NASA CONTRACTOR 
REPORT 



ANALYSIS AND PRELIMINARY DESIGN 
OF AN ADVANCED TECHNOLOGY 
TRANSPORT FLIGHT CONTROL SYSTEM 

Ronald Frazzini and Darrel Vaughn 

Prepared by 
HONEYWELL INC. 

Hopkins, Minn. 
for Langley Research Center 

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION • WASHINGTON, D. C. • MARCH 1975 






1. Report No. 2. Government Accession No. 

NASA CR- 2^490 

3. Recipient's Catalog No. 

4. Title and Subtitle 

AKAL^SIS AND PRELIMINARY DESIGN OF AN ADVANCED TECHNOLOGY 

5. Report Date 

MARCH 1975 

TRANSPORT FLIGHT CONTROL SYSTEM 

. 6. Performing Organization Code 
14.U0 

7. Author(s) 

Ronald Frazzinx and Darrell Vaughn 

8. Performing Organization Report No. 


10. Work Unit No. 

9. Performing Organization Name and Address 

501-23-32-00 

Honeywell, Inc. 

Government and Aeronautical Products Division 
Hopkins, MN 

11. Contract or Grant No. 

NASI-121437- 


13. Type of Report and Period Covered 

12. Sponsoring Agency Name and Address 

Contractor Report 

National Aeronautics and Space Administration 
Washington, D-C. 205^ 

14. Sponsoring Agency Code 

15. Supplementary Notes 


FINAL REPORT. Project Monitor, Fred Lallman, Flight Dynamics 
Langley Research Center, Hampton, Va. 

and Control Division, NASA 


16. Abstract 


The general objective of this program was to perform the analysis and preliminary 
design of an advanced technology transport aircraft flight control system using avionics 
and flight control concepts appropriate to the 198O-I985 time period. • Specifically, the 
techniques and requirements of the flight control system were established, a number of 
candidate configurations were defined, and an evaluation of these configurations was 
performed to establish a recommended approach. 


Twenty-four candidate configurations based on redundant integration of various sensor 
types, computational methods, servo actuator arrangements and data- transfer techniques were 
defined to the functional module and piece-part level. Life -cycle costs, for the flight 
control configurations, as determined in an operational environment model for 200 aircraft 
over a 15-year service life, were the basis of the optimum configuration selection tradeoff. 
The recommended system concept is a quad digital computer configuration utilizing a small 
microprocessor for input/output control, a hexad skewed set of conventional sensors for 
body. rate and body acceleration, and triple integrated actuators. 


17. Key Words (Suggested by Author(s)) 18. Distribution Statement 

Advanced Technology Transport 
Digital Controls 

Controls Unclassified - Unlimited 

Fly -By -Wire 



STAR Category: 02 

19. Security Qassif. (of this report^ 

20. Security Classif. (of this page) 

21. No. of Pages 

22. Price* 

Unclassified 

1 Unclassified 


h 23 

$10.50 


For sate by the National Technical Information Service, Springfield, Virginia 22151 

























FOREWORD 


This report covers the work conducted under NASA Contract Number 
NAS 1-12437, "Analysis and Preliminary Design of an Advanced Technology 
Transport Aircraft Flight Control System". The program was administered 
under the direction of the Flight Dynamics and Control Division of NASA- 
Langley. 

The report covers work performed between June 1973 and February 

1974. 


The study was performed by the Government and Aeronautical 
Products Division of Honeywell Inc. under the direction of Ronald Raymond. 
The principal contributors were James Coult, Ronald Frazzini, William 
Glasser, Harry Graves, Court Maronde and Darrel Vaughn. Mr. Robert 
Rasmussen of Tri-Tec Associates contributed in the area of actuators and 
hydraulics. The assistance of Richard Coykendall, Manager, New Aircraft 
Development, United Air Lines, San Francisco, California, through telecon 
and written consultation is gratefully acknowledged. 


iii 



Page intentionally left blank 



CONTENTS 


Page 

FOREWARD iii 

SUMMARY 1 

1 INTRODUCTION 5 

2 VEHICLE DEFINITION 10 

Primary Vehicle Characteristics 10 

Vehicle Flight Controls 10 

Mechanical Flight Control Linkages 13 

Control Surfaces 13 

ATT Electrical Power System 15 

ATT Hydraulic System 16 

Pilot Interface Equipment 19 

3 FCS REQUIREMENTS 20 

Flight Safety and Reliability 21 

Maintainability 24 

Functional and Performance Requirements 25 

Compatibility Requirements for Projected Aircraft 27 

Mode, Status, and Crew Advisory Displays . 28 

4 FCS FUNCTIONAL CAPABILITIES 31 

System Modes and Functions 31 

Relaxed Static Stability, Mach Trim System 33 

Flutter Suppression System 33 

Maneuver and Gust Load Alleviation System 37 

Direct Lift Control 37 

Yaw-Axis Control 39 

Pitch-Axis Control 41 

Roll -Axis Control 46 

5 SYSTEM DEFINITION AND DESIGN PROCESS 53 

Redundancy 53 

Digital Flight Control Sizing 66 

6 COMPONENT TECHNOLOGY TRADEOFFS 90 

Actuation Study 90 

Flight Control Actuator Evolution . 92 

Implementation Considerations 95 

Redundancy Management Considerations 108 

Air Data Computation .............123 

Displays 125 

Electronics 126 

Integrated Circuit Technology ............... 127 

High-Efficiency Line-Operated Ultrasonic Inverter .... 128 

Stitch-Wired PC Boards. . 129 

Sensors 129 

Position Pickoff Sensors 130 

Angular Rate Sensors 130 

Linear Acceleration Sensors 136 

Skewed Sensor Arrays 137 

Processors 143 

Processor Trends 145 

Projected Processor Characteristics .. . . . . 147 


V 



Page 


7 


8 


9 


Incremental Versus Whole-Word Processor 

Implementation , . . , 

Tileihory 

Signal Flow Transmission 

Frequency Division Multiplexing (FDM). 

Time Division Multiplexing (TDM) 

Global Versus Dedicated Busses . . . . . . . . . . . 

CANDIDATE CONFIGURATIONS 

Operational Reliability . 

System Reliability 

Assumptions and Approximations .• . . . 

Satisfaction of Requirements ; 

Configuration Descriptions 

Configuration 1 

Configuration 2 . 

Configurations 

Configuration 4 . . . 

Configuration 5 . . . 

Configuration 6 

Configuration 7 

Configuration 7A ; 

Configuration 8 

Configuration 9. . . . . . . . . ... . . 

Configuration 9A . . . . 

Configuration 10 . 

Configuration 11 . 

Configuration 12 

Configuration 13 

Configuration ISA 

Configuration 14 

Configuration 14A 

Configuration 15 

Configuration 16 

Configuration 17 

Configuration 18 

Configuration 19 

Configuration 20 

Hardware Mechanization 

OPERATIONAL MODEL 

Operational Characteristics 

Maintenance Support Assumptions 

Control Hardware Testing, Maintenance Assumptions and 

Requirements 

System Reliability Considerations 

Initial Costs 

Operations Costs Due to Delays, Diversions and 

Cancellations 

OPTIMUM CONFIGURATION SELECTION 

Life -Cycle Cost Determination 

Production Costs 


151 

162 

164 

165 

166 
169 
171 
171 

173 

174 
'175 

175 
175 
180 
183 
191 
194 
200 
205 
205 
208 
208 
213 
213 
217 
220 
220 
226 
226 
231 
231 
234 
234 
236 
241 
241 
244 
274 
274 
276 

284 

287 

292 

294 

298 

298 

300 


VI 



Page 

Support Costs . 302 

System Mean Time to Failure Incidents (MTBF). 302 

^ System Maintenance Manhours and Test Equipment 307 

System Weight . . . 313 

Summary 313 

10 SELECTED SYSTEM DESCRIPTION 321 

< Line -Replaceable Units (LRUs) 323 

^ Operational Reliability 326 

Construction 326 

Functional Operation 326 

Computational Operations 330 

11 CONCLUSIONS 342 

' . General 342 

Specific 343 

12 FURTHER STUDIES 351 

Flight Control /Propuls ion Control Integration for Fuel 

Conservation 351 

Redundancy Monitoring Techniques 353 

Redundancy Management/ Signal Select 354 

Natural Hazards /Lightning Strike 355 

Pilot Interface/Annunciation and Displays 356 

APPENDIX A - STUDY METHODOLOGY 357 

APPENDIX B - GLOSSARY 379 

APPENDIX C - SYSTEM SENSITIVITY STUDIES 399 

REFERENCES 407 


vii 



Page intentionally left blank 



ILLUSTRATIONS 

Figure Page 

1 Selected System — Simplified Block Diagram 2 

2 System Configuration Tree 8 

3 ATT Mach . 90 Configuration 11 

4 ATT Mach . 98 Configimation 12 

5 Flight Control Surfaces 14 

6 Electrical Power System for Quad Fly-by-Wire FCS 17 

7 Hydravilic Power System 18 

8 Variation of Aerodynamic Static Margin During Typical 

Flight Profile 26 

9 Longitudinal Short- Period Characteristics 26 

10 Baseline System Fionctional Block Diagram 34 

11 Relaxed Static Stability, Mach Trim System Functional 

Block Diagram 35 

12 Flutter Suppression System Functional Block Diagram .... 36 

13 Maneuver and Gust Load Alleviation System Functional 

Block Diagram 38 

14 Yaw -Axis SAS and Autopilot Functional Block Diagram .... 40 

1 5 Pitch-Axis CAS and Autopilot Functional Block Diagram ... 42 

16 Go- Around Control System Functional Block Diagram 47 

1 7 Roll- Axis SAS and Autopilot Functional Block Diagram .... 48 

18 Analog Crossfeed and Processor Intercommunication 

Cross -Strapping Methods 63 

19 Hydraulic Actuator Spring-Mass Analogy 97 

20 Driver /Surface Actuators - Generalized Configimations. ... 99 

21 Driver Actuator - Surface Actuator System Mechanizations. . 101 


IX 



Figure Page 

22 Single -Channel Integrated Actuator for Constant- 

Pressure Supply 103 

23 Single -Channel Integrated Actuator with Electrically 

Driven Servopump 106 

24 Position Summing 109 

25 Split Surfaces • • • 

26 Velocity-Summed Electromechanical Servoactuator Ill 

27 Force-Summed Electrohydraulic Driver Actuator ...... 112 

28 Limits of "Lowered Force Gain" Type Equalization ..... 113 

29 Active /On- Line Actuator Concept Block Diagram ...... 115 

30 Servo Monitor Minimum Time Delay to Prevent 

Nuisance Disengagement 122 

31 GG2500 MHD Rate Sensor - Cutaway View .......... 132 

32 MHD Theory of Operation i32 

33 Angular Accelerometer 133 

3 - 

34 GG326 Linear Accelerometer 137 

35 Class I Optimum Arrays, Equally Spaced on a 54. 75-deg 

Cone 139 

36 Relative Accuracy of Redundant Arrays 144 

37 Integrator Realization of Transfer Functions ......... 152 

38 Integrator Realization of a Synchronizer 155 

39 Fade- In/Bleed- Off DDA Realization . 157 

40 FBW Computer Block Diagram - Three Channels, 

One Branch . . 159 

41 Memory Cost Comparison 153 

42 Candidate Configuration Tree 172 

43 Configuration ! Functional Redundancy Block Diagram. . . . 176 


X 



Figure Page 

44 . Configuration 1 Control Surface Actuators - Quad- 

Driver arid Triple-Surface (91 cylinders) 178 

45 Configuration 1 Success Path Diagram 179 

4'6 Configuration 2 Fianctional Redundancy Block Diagram 

(typical Class A functions) 181 

47 Configuration 2 Control Surface Actuators - Triple- 

' Integrated (39 cylinders). 182 

48 Configtiration 2 Success Path Diagram ............ 184 

"49 Configuration 3 Functional Redundancy Block Diagram. ... 185 

50 Configuration 3 Digital Computation (one of four channels). . 186 

51' Configuration 3 Multiplex Terminal Unit (MTU) 188 

52 Configuration 3 Analog Subsystem Interface Unit (SSIU) ... 189 

53 Configuration 3 Bus Control Interface Unit (BCIU) ...... 190 

54 Configuration 3 Dual- to- Quad Bus Interface 192 

55 Configuration 3 Success Path Diagram 193 

56 Configuration 4 Success Path Diagram 195 

57 Configuration 5 Functional Redundancy Block Diagram. ... 196 

58 Configuration 5 Digital Computation (one of four channels). . 197 

59 Configviration 5 Detailed Block Diagram (one of fovir 

channels) 199 

60 Configuration 5 Success Path Diagram 201 

61 Configviration 6 Functional Redimdancy Block Diagram. ... 202 

62 Configuration 6 Digital Computation (one of four channels). . 203 

63 Configiiration 6 Detailed Block Diagram (one of four 

channels) 204 

64 Configuration 6 Success Path Diagram 206 

65 Configuration 7 Success Path Diagram . 207 


XI 



Figure 


Page 

20.9 


66 Configvu:*ation 8 Functional Redundancy Block Diagram . . 

67 Configuration 8 Digital Computation (one of four channels) , 210 

68 Configxoration 8 Success Path Diagram . 211 

69 Configiiration 9 Functional Redundancy Block Diagram . . , 212 

70 Configuration 9 Digital Computation (one of fom* channels) . 214 

71 Configuration 9 Block Diagram (one of four channels) .... 215 


72 Configuration 9 Success Path Diagram . 216 

73 Configiiration 10 Success Path Diagram 218 

74 Configuration 11 Success Path Diagram 219 


75 Config\iration 12 Functional Redundancy Block Diagram. . . 221 

76 Configxmation 12 Digital Computation (one of four channels). 222 


77 Configuration 12 Control Siorface Actuators - Minimum 

Acceptable Set 223 

78 Configuration 12 Success Path Diagram ; . . . . ; . / . . . 224' 

79 Configiiration 13 Functional Reduhdacy Block Diagram . . , 225 

80 ' Config\iration 13 Success Path Diagram . .... . ... . 227 

81 Configimation 14 Functional Redund^cy Block Diagram . . 228 


82 Configuration 14 Digital Computation (one of four channels). 229 

83 Configuration 14 Detailed Block Diagram (one of three 


channels) 230 

84 Configuration 14 Success Path Diagram 232 

85 Configvuation 15 Success Path Diagram 233 

86 Configuration 16 Success Path Diagram 235 

87 Configuration 17 Success Path Diagram 237 

88 Configuration 18 Digital Computation 238 

89 Configuration 18 Detailed Block Diagram - Flight- 

Critical Processor (one of three channels) 239 


Xll 



Figure 


Page.. . 


90 ' 

91 

92 
93*' 
9V 

95 " 

96 

97 " 
98 ^ 

s 

99 ' 
100 
101 : 
102 . 

103 . 

104 
105 . 
106 

107 

108 

109 

110 
111 
112 
113 


. Configuration 18 Detailed Block Diagram - Non- Flight-. 

Critical Processor (one of two channels) 240 

Configxiration 18 Success Path Diagram 242 

Configuration 19 Success Path Diagram 243 

Configviration 20 Success Path Diagram . 245 

Demod Excitor Parts List Printout 248 

Demod Excitor Circuit Diagram 248 

D-C Analog Input Parts List Printout 249 

D-C Analog Input Circuit Diagram 250 

Discrete Input Parts List Printout 251 

Input and Signal Conditioning Circuit Diagram 252 

A-C Analog Input Parts List Printout 253 

A-C Analog Input Circuit Diagram .. . .. . .... 254 

A/D Converter Parts List Printout . . . • ,* • * 

I/O Control Parts List Printout. .. . • • • * • 255 

I/O Control Logic • • . . • • * * • • • .• • • • 256 

Avionics /Flight Control Bus Interface .... ....... . . 257 

. DMA Control Parts List Printout. ....... . ...... 258, 

DMA Control .Circuit Diagram • . • • .... . . . 258 

NRZ Receiver Parts List Printout 259 

NRZ Receiver Circuit Diagram 259 

NRZ Register Parts List Printout 260 

NRZ Register Circuit Diagram 260 

Manchester Transmitter-Receiver Parts List Printout . . . 26i 

Manchester Transmitter-Receiver Circuit Diagram ..... 262 


xiii 



Figure -Fage?- 

114 - Sample/Hold Paris List Printout . . i . . v . . 26^3' ' 

115 Sample/Hold Circuit'Diagram , . . . 263 - 

lid Processor Cards (Small) Parts List Printout . i', . , 26'4 

117 Processor Cards (Medium) P'arts’ List Printout .•••; , . 264' 

118 Memory Board P^ts Ligt Printout . . . . . , • • 

119 ' Memory Board Circuit Diagram . . . ; i i ; , . 265 

120 Synchronizing Logic Parts List Printout . . . 266 a 

121 Synchronizing Logic Circuit Diagram . . 266 

122 Servo Amplifier Parts List Printout . 26 7 

123 Servo Amplifier Circuit Diag^ram . 267 

.124 Discrete Output Parts List Printout . 268 

125 Discrete Ouput Circuit Diagram 268 

126 Discrete Output (Power) Parts List Printout. , 

127 Power Supply Parts List Printout . . ... -. . .' .■ . . '. . . 270 

128 Chassis Parts List Priritout . •. . . v ; . .- . . . . .’ . . . . 271 

129 Electronic Piece- Part Catalog Printout 272 

130 Operational Flight Profile 275 

131 Route Structure 277 

132 Maintenance Flow Diagram 278 

133 Daily Operational Profile 295 

134 System Cost Breakdown 301 

135 System Support Cost as a Function of Production Cost - 

Dispatch Delay Costs Included 304 

; 136 System Support Cost as a Function of Production Cost - 

Dispatch Delay Costs Removed 305 

137 Mean Time Between Failure Incidents, Including 

False No-Go's. 306 

xiv 



Figure Page. 

138!‘: Operational Reliability versus Production. Cost . . . 308 

139 , Total- Fleet On- Aircraft Maintenance, Manhovirs . ... . . . 309 

140 Total- Fleet Off-Aircraft Maintenance Manhours . .... . . 310- 

141.- Maintenance Manhours per Flight Hour (based on an 

operating-to-flight-hours ratio of 1. 25) 312 

142 System Weight as a Function of Production Cost and 

Configuration . . ...... . . . . . ... . . 314 

143: Life-Cycle Costs as a, Function of System. Production 

Cost Including Operational Delays . .............. 317 

144 Comparison of Major Systems • 318 

145 Selected System (13A) Functional Block Diagram 322 

146 Selected System Success Path Diagram ...... 327 

147 Selected System LRU -Level Block Diagram. 328 

148 Selected Computation Configuration . 331 

149 Selected System Small Processor (lOP), Block Diagram 

(one of four channels). 334 

150. Selected System Control Computation Processor (CCP) 

Block Diagram 339 


‘ f 


XV 



Page intentionally left blank 



TABLES 

Table Page 

1 Operating Environments 29 

2 Transfer Functions 73 

3 Nonlinear Functions 73 

4 And/ Or Gate Requirements 74 

5 Landing /Go “Around Time Sizing 80 

6 Enroute System Time Sizing (Outer Loops) 81 

7 Critical System Time Sizing (Inner Loops) 82 

8 lOP Time Sizing 83 

9 CCP Time Sizing 83 

10 Single “Processor Time Sizing. . 84 

11 Landing /Go “Around Memory Sizing 85 

12 Enroute System Memory Sizing 85 

13 Critical System Memory Sizing 86 

14 Processor and Memory Sizing Summary 89 

15 Technology Survey Areas 91 

16 Comparison of Active with Active/On-Line Redundancy ... 117 

17 Comparison of Active Versus Standby Redundancy 118 

18 Sensor Configurations 124 

19 Display Technologies 1 125 

20 Processing Equations and Accuracy Summary 140 

21 Central Processors Considered 147 

22 Computer Hardware Requirements 160 

23 Memory Characteristics 163 

24 Cost, Weight and Reliability for Hydraulics and Sensors. . . 246 


xvii 



Table Page 

25 Major GSE Component Listing . . 280 

26 Preliminary Quantitative On -Aircraft Maintainability 

Area * 285 

27 Honeywell Piece-Part Failure Rates 288 

28, Life-Cycle and Production Cost Comparison 300 

29 Production Cost Breakdown- . . . , ... . , . . . . . . . . 303 

30 System Weight Breakdown 315 

31 System Data Summary . 316 

32 System 13A Life-Cycle Cost Breakdown i . i . . 319 

33 System 13A Cost Summary . . , . . . . , , . . 319 

34 Selected System Physical Characteristics . . . ... . , 325 

35 Total I/O Sizing . ... , . ... . .' . . .' . . . 336 


xviii 



• ANALYSIS AND PRELIMINARY DESIGN " ^ 

OF AN. ADVANCED TECHNOLOGY TRANSPORT- , • ; 

FLIGHT CONTROL SYSTEM 

' By itlonald Frazzini and Darrel' Vaughn 

. . Honeywell Inc. ‘ . 

, , SUMMARY 

The general objective of this program was to perform the analysis 
and preliminary -design of an advanced technology transport •aircraft flight .' ' 
control system using avionics and flight control concep^ appropriate to the - 
1980-1985 time period. Specifically, the techniques and requirements of 
the flight control system were established, a number of candidate configura- 
tions were defined, and an evaluation of these configurations was performed 
to establish a recommended approach. 

Twenty- four candidate configurations based on redundant integration 
of various sensor types, computational methods, servo actuator arrange- 
ments and data-transfer techniques were defined to the functional module 
and piece-part level. Life-cycle costs, for the flight control configurations, 
as determined in an operational environment model for 200 aircraft over a 
15-year service life, were the basis of the optimum configuration selection 
tradeoff. 

The recommended system concept is a quad digital computer configura- 
tion utilizing a small microprocessor for input/output control, a hexad 
skewed set of conventional sensors for body rate and body acceleration, and 
triple integrated actuators. This configuration is shown in Figure 1 in a 
simplified system-level block diagram. Characteristics of the recommended 
system are: 
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• Flight reliability: 0. 63 x 10 probability of failure per flight hour 

• System initial cost: $352, 000 per shipset 

• System weight: 1069. 7 pounds per shipset 

• Shop maintenance manhours per flight hour: 0. 0215 

• Total life cost (15 yr/200 aircraft): $246 million 

• System MTBF: 201 hours 

These are only a few of the parameters examined for the study; they 
and the others employed are discussed fully in the body of the report. 

The results of the study show that the most cost-effective flight control 
system for an ATT aircraft using extensive active control technology can be 
implemented' with the following technologies: 

• Computation - general-purpose digital 

• Sensprs conventional, gyros and accelerometers 

• Actuation - integrated hydraulic packages 

The overall computational requirements of the ATT flight control 
system cannot be cost-effectively achieved with an analog system design. 

The computation task requires the use of a digital processor. The system 
requires a high- integrity BIT capability, a capability which is less expeh- , 
sively implemented digitally. These factors allow the required functions to 
be implemented at minimum life-cycle cost in a general-purpose digital- 
processor. 

Conventional spinmotor rate gyros, and pendulous force-rebalance 
accelerometers provide the best solution for meeting the sensing require-, 
ments; all are currently used in flight control systems. The use of advanced 
types of inertial sensors is not indicated because they do not appear cost 
effective at the precision level needed for control system use (as opposed to 
the precision level needed for navigation systems). 
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Hydraulic actuation is projected as superior to other alternates, and 
the integrated hydraulic package is the most attractive mechanization. It 
provides the minimum cost per function because a single device accepts 
electrical command signals and outputs surface position and because it 
allows simplified monitoring and fault reaction since no intermediate cross- 
feeds are required. 
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SECTION 1 • 

INTRODUCTION 


••• •• • •' • ■■ ■ . .--r . 

'.. This document. reports on the results of a -Preliminary Design and .-o;', 
Analysis of a Flight Control System for the Advanced Technology Transport.- i 
(ATT) under NASA contract NASl-12437. The ATT is an advanced aircraft 
designed to operate in the 1980' s and is a medium-range and payload aircraft 
aimed at the high-density airline routes. It embodies the full range of 
current commercial transport flight control capabilities plus a fly-by-wire 
(FEW) primary flight control system and higher-order control modes (active 
control techniques- ACT) included to reduce aircraft weight and increase 
operating efficiency, resulting in significant improvements in operating costs. 
The airframe used as a basis for this study is the Convair configuration 
which was established as a model in an earlier study conducted for NASA- 
Langley. 

The objective of this study was to provide a preliminary design of the 
ATT flight control system which is appropriate to and meets the operational 
needs for an aircraft entering revenue service in 1980. The FCS study in 
conjunction with other previous NASA studies forms a total picture of the 
impact of a FBW/ACT implementation. 

The scope of the work performed includes the appropriate trade 
studies in reliability, complexity, redundancy, maintainability, and cost. 

This was accomplished by selecting the most promising mechanizations for 
sensor, actuator, computer, data flow, and other implementations and then 
configuring a series of candidate systems from these selected components. 
These candidate systems were then evaluated in trade studies to select a 
recommended system and present a rationale for its recommendation. 

The ATT flight control system (FCS) includes a full set of flight control 
modes presently utilized in commercial jet transport aircraft, including 
pilot relief, control wheel steering, area navigation coupling, along with 
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automatic landing, roll-out and go-around modes. In addition, the ATT FCS 
includes two highly significant innovations in automatic flight control — a 
fly-by- wire (FBW) system which replaces the mechanical coupling to the 
surface actuators with electrical coupling and higher-level control modes 
(ACT) which improve passenger comfort and structure fatigue life and at 
the same time, allow a less expensive airframe with a lower operating cost. 

The ACT configured vehicle is a less expensive aircraft to build 
because structural rigidity and control surface area design requirements 
can be relaxed, and the operating cost of the aircraft is less because it naay 
be designed to maximize economy. 

The FCS candidate systems were designed to the basic requirements 
mutually defined by NASA- Langley and Honeywell. These requirements 
included the functional requirements, the flight reliability requirement, the 
maintainability requirement and the basic tradeoff requirement minimum 
life-cycle cost where life-cycle cost is the sum of the initial cost and the 
operating cost or cost-of-ownership. 

The candidate system concept tradeoff study utilized life -cycle cost 
on the following basis. The initial cost portion was generated through a 
computerized compilation technique which uses a common library of imple- 
mentation parts (resistors, capacitors integrated circuits, etc. ) and with 
the defined mechanization for each candidate systems, compiles cost and 
reliability for each. All nonrecurring costs such as design and development 
are included in the initial cost. The costs and reliability are fed to a com- 
puterized model of the operational environment of the ATT in the 1980 - 1985 
time frame. This model then outputs the operating cost of each candidate 
system. 

The candidate system concepts were constructed during the technology 
survey/forecast and component- selection phases of the program. During the 
technology survey, evaluations of the design and development risk for each 
technology of interest were made, and only those components with a reason- 
able forecast for availability in 1978 were carried forward to the candidate 
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systems. The technology forecast also resulted in projected costs and reli- 
ability for each component used to construct the candidate systems. 

The "system configuration tree, " Figure 2, shows how the candidate 
systems were constructed. Each level of the system configuration tree is 
dedicated to an implementation variation such as computer technology or 
sensor implementations. A total of 24 candidate systems were constructed, 

20 candidates initially with four additional candidates (those with an A- suffix) 
added as greater insight was developed into the tradeoff program. The sys- 
tem configuration tree and the initial life-cycle-cost data allowed the genera- 
tion of more optimized configurations for study; consequently, the recommen- 
ded system concept, number 13A, was not one of the initially constructed 
systems but was a configuration developed using the configuration tree. 

In the balance of this report. Sections 2 through 5 provide the funda- 
mental vehicle and control system definition together with anticipated 
requirements necessary to perform the FCS analysis and preliminary 
design. Section 2 includes the pertinent characteristics of the ATT aircraft 
as defined by General Dynamics -Convair. Section 3 contains the flight 
control system requirements as specified by NASA- Langley, derived from 
the Convair ATT data, or developed by Honeywell on the basis of previous 
experience. Section 4 describes FCS capabilities and characteristics 
assumed and/or defined by Honeywell as a result of the brief analysis and 
preliminary design effort. Section 5 describes the flight control system 
preliminary design process including some of the early decisions concerning 
redundancy and monitoring which established the various candidate configura- 
tions. Section 6 combines a technology survey and component tradeoff 
discussion to present the concepts used to reduce the unmanageable number 
of possible configurations to a reasonable array for selection of the optimum 
configuration. Section 7 gives a brief description of each of the candidate 
configurations and details the manner in which each configuration was 
mechanized from the piece-part level. Section 8 presents the model of 
the operational environment, including route structure and maintenance 
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philosophy. Section 9 describes the rationale for selection of the recom- 
naended configuration. Section 10 provides a detailed description of the 
mechanization of the optimum configuration. Section 11 includes the study 
conclusions. Section 12 indicates the recommended areas for further study. 
Appendix A describes the tradeoff methodology used to provide a consistent 
evaluation of each configuration. Appendix B is a glossary of terms. 
Appendix C presents sensitivity studies of the configurations which illustrate 
the effects of various changes in the mechanization and/or maintenance 
philosophy. 


9 



SECTION 2 

VEHICLE DEFINITION 


Honeywell has been supplied with reports prepared by General 
Dynamics-Convair under contract NAS 1-10702 to support this ATT study. 

The final vehicle configurations recommended in these reports were used 
to define the basic airframe in the Honeywell study. 

Primary Vehicle Characteristics 

The two different aircraft configurations, shown in Figures 3 and '4 will 
be developed for the two cruise speeds, mach . 90 and .98. The preliminary 
design of the FCS will be essentially identical for the two aircraft configura- 
tions; therefore, all FCS configurations are considered applicable to both 
vehicle configurations. Other features include: 

• Both aircraft configurations will be designed to carry a 40 000-pound 
payload for a 3000-nautical-mile range. 

• Both configurations will have three engines, two wing-mounted ahd 
one tail- mounted. 

• Only the mach , 98 aircraft, will have an area-ruled fuselage. 

• An economic service life of 15 years is assumed. 

• A design fatigue life of 30 years or 120 000 flight hours is assurried. 

Vehicle Flight Controls 

The characteristics of the Convair ATT design indicate it will require 
higher level control functions to be integrated into the aircraft structural, 
aerodynamic and propulsion design. The result of an integrated approach is 
a vehicle which has reduced weight, improved controllability, ride quality 
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.^Figure 3. - ATT Mach . 90 Configuration 











and maneuverability, longer aircraft life and decreased drag. The active 
control techniques (ACT) offer improved mission effectiveness at a signifi- 
cantly lower operating cost. 

. 

Mechanical Flight Control Linkages 

It is assumed that mechanical linkages to the control surfaces will 
not be provided in the ATT because they cannot provide adequate control of 
the vehicle to assure passenger safety and aircraft structural integrity. 
Stability augmentation is necessary to maintain a satisfactory stability 
margin. The fly-by-wire system, consequently, will not be a simple direct 
electrical link but. will require the active elements necessary to provide the 
higher level control capability. 

. . Control Surfaces 

.The following control surface configuration, defined in the Convair 
data and used as a baseline in the FCS study, are shown in Figure 5, a plan 
form of the mach . 98 version: 

• Ailerdns (mid- span) 

• - Flaps (inboard) - three-section double -slotted Fowler type 

• Flaps (midspan) - three- section double- slotted Fowler type 

• Flaps (outboard) - two- section simple hinged type 

• Horizontal stabilizer 

• Rudder - two- section 

• Spoilers (midspan) 

• Spoilers (tip) 

• Wing flutter suppressor (outboard trailing edge) 

• Wingtip flutter suppressor 

r 
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The lateral control surfaces on each wing are tip spoiler, midspan 
spoiler and midspan aileron. Any two of these three surfaces shall provide 
safe control capability. 

The directional control is provided by a two-section rudder; either 
section alone shall provide safe control capability. 

Flutter suppression is provided by wingtip and outboard wing tr ailing - 
edge surfaces. Flutter control is necessary throughout the ATT flight 
regime. Both sets of surfaces must be operating to provide safe control 
capability. 


ATT Electrical Power System 

The primary electric power is derived from three alternators, one 
on each engine, feeding three separate and isolated sets of three-phase 
buses with 115-volt, 400-Hz alternating current. A fourth alternator, 
identical to those driven by the main engines, is provided on the auxiliary 
power unit (APU), and it can automatically be switched in to replace any one 
of the three primary alternators. The primary function of the auxiliary 
power, unit is to -furnish power for the aircraft systems on the ground. 

i 

Three +28-Vdc buses are independently powered from the three a-c 
buses by transformer /rectifier sets. 

Emergency power is provided to the emergency bus on a short-term 
basis by a battery and on a long-term basis by a ram air turbine (RAT) 
driving an alternator. The battery is kept in a fully charged condition by 
a battery charger from the a-c system. The charger is capable of re- 
charging the battery at the same rate it is discharged. 

Operation of the RAT deploy handle places the RAT in the air stream. 
When deployed, it automatically comes up to speed and supplies three-phase, 
115-volt, 400-Hz power. 
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A special arrangement of the triple engine-driven electrical genera- 
tion is necessary for quad -redundant FCS configurations. The electrical 
generation and distribution must be free of bus-to-bus fault propagation and 
must assume that power bus failures do not occur simultaneously. Figure 6 
illustrates such an electrical system which co\ild be utilized for a quad FCS. 

In this electrical system, the fourth independent bus '(capacity 'of less than 
1000 watts) is driven by three common-shaft electric motors, each of. which 
is driven from an independent bus supplied by an engine-driven generator*; 
Each electric motor is capable of driving the fourth bus. alternator alone.- 

The characteristics of the power system described above shall be'” 1 
defined by specifications similar to MIL-STb-'704, and, for the purposes of 
this study, it is assumed that the power system will meet the present require- 
ments of MIL-STD- 704. : / ' 

Since the FCS contains the critical augmented fly-by-wire function, 
the FCS (utilization equipment) must provide full performance- capability for 
both normal and abnormal electric system operation as defined in the appli- 
cable specification. I ; ■ 

Flight crew selection of the three , primary electrical 'buses ;is not 
required; automatic bus switching following power bus faults will not cause 
operation outside the normal voltage transient limits. The automatic bus 
fault monitoring and switching is a function of the electrical power distribu- 
tion system. 

All interrupt and fault sequences on the electrical bus systems are to 
be considered lionsimultaneous; the probability oT simultaneous alternator or 
power bus faults in a good electrical system is considered insignificant. 

ATT Hydraulic System 

The recommended ATT hydraulic system consists of three separate, 
parallel, closed-circuit hydraulic systems, each supplied from three pumps 
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Figiore 6* - Electrical Power System for Quad Fly-by-Wire FCS 




as indicated on Figure 7. Six of these pumps are located on the three main 
engine accessory gear boxes, and three auxiliary pumps are driven by an 
electric motor powered from the APU. 



Figure 7. - Hydraulic Power System 


. c 


These.three systems are used only for inflight power to the flight 
control system sind nonflight functions such as wheel brakes; separate utility . 
supplies are provided for landing gear arid other nonflight control actuators. 

FAA-approved Skydrpl 500B/Hyjet W/Aerosafe 23000W will be used as 
the baseline fluid in conjunction with proven seals, shaft materials and valve 
configurations at 3000 psi. Bulk modulus for analytical purposes is assumed 
to be 150,000 psi. An all-metal piping system designed for essentially 
infinite service durability will be used. 
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Pilot Interface Equipment 


The primary controls include the control wheel and column, rudder 
pedals, and manual trim controls. 


The control wheel and column and rudder pedals are assumed to be 
implemented as displacement devices, with force gradients^ viscous damping, 
maximum travel stops and other feel and harmony characteristics to be 
defined and built in by the airframe manufacturer. 

The control column, wheel and rudder pedals operated by the captain 
are directly coupled to those controls operated by the first officer through a 
breakaway linkage. Thus, the command position transducers are synchronized 
for the two sets of controls except in the event of a control jam. 

The only FCS portions of these controls are the redundant control 
position pickoffs. 

No followup servos will be required; parallel motion of the pilot 
controls for FCS-commanded augmentation and control is not required. 

The pitch manual trim will be by beep trim switches on the control 
wheel; roll and yaw trim will' be by control panel trim wheels with position 
pickoffs. 



SECTION 3 
FCS REQUIREMENTS 


The system requirements to which the ATT flight control is defined, r 
may be divided into five categories: 

• Flight safety and reliability 

• Mciintainability 

• Functional performance 

• Projected aircraft compatibility 

• Pilot interface displays 

The requirements in these categories are derived from several 
sources. The primary source is the statement of work for the analysis and 
preliminary design of this program. Other requirement sources are the air 
frame manufacturer' s study documentation, existing specifications, data from 
airlines (particularly United Air Lines), and from exchanges with personnel 
from NASA-Langley, 

Another primary requirement exists: that the recommended system 
configuration provide the lowest life-cycle cost while meeting the other 
requirements discussed in this section. The life- cycle cost requirement is 
the salient trade study quantity and is utilized to make the final decision on 
a recommended system. 

The basic requirement for the ATT FCS is to provide an optimum 
design for the projected ATT airframe in the 1980-1985 time frame and in 
the anticipated commerical transport operating environment. The following 
subsections describe the requirement sets, their source and rationale, any 
extrapolations considered necessary to present requirements, and, where 
necessajry, the ground rules and computations necessary to describe some 
requirements. 
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Flight Safety and Reliability 

The program contract requires that system configurations be studied 

_7 

with reliability over the range of 1. 0 x 10 flight control system function 
losses per flight-hour. ...... 

To validate this level, an investigation was made of commercial air- 
line experience with mechanical primary flight control system reliability. 

The data obtained from CAB and NTSB sources showed the following: 

Period Accident /failure rate . 

1952-1959 2. 32 x 10 '^/flight hour 

1962-1969 1. 19 x 10 "^/flight hour 

This data confirms the NASA requirements for flight reliability in 
this range. 

To compute the flight' reliability for each candidate configuration, ' 
certain basic groundrules were used: ' 

• The loss of any class A function is considered to be catastrophic and 
is to be included in the 10 -hour goal. 

• To assure a worst-case flight reliability computation, the maintenance 
is considered to be performed only at maintenance stations. Since, in 
the operational model used, only one of each four stations has main- 
tenance facilities, and, since the average time between stations is' 

1. 6 flight hours and 2. 0 operating hours, the time between available 
maintenance is 8. 0 hours operating time. 

• Candidate configurations will be eliminated from the study unless they 
substantially meet the 10 -hour flight reliability requirement 
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• Any portion of the FCS which is required for the ACT/FBW functions 
must tolerate at least three parallel failures before a loss of fxinction 
occxirs. This is to ensure that a single failxire occurrence will not 
cause an aircraft to be grounded between maintenance stations. 

• No single-point success paths will be permitted regardless of the 
reliability level. 

I 

To assure flight safety, all candidate configurations will be designed 
to satisfy the Federal Aviation Regulations for airworthiness of transport 
aircraft; FAR 25. The FAR paragraphs considered applicable for the FCS are: 


25. 671: 
25. 672: 

25. 1301 
25. 1329: 


General (control system) 

Stability augmentation and automatic, and power 
operated systems. 

Equipment systems and installations 
Automatic pilot system 


The flight control system functions have been subdivided into the 
following classes, dependent on their flight safety criticality. 

• Class A - loss of function is catastrophic (ACT/FBW) 

• Class B - loss of function is critical (autoland) 

• Class C - loss of function must be fail-safe (cruise and relief modes) 

The placement of the various functions and/or modes in the above 
classes is as follows; 

• Class A (ACT/FBW) - 

Pitch CAS/SAS 
- Roll CAS/SAS 
Yaw CAS/SAS 
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Relaxed static stability 
Mach trim 

Wing flutter suppression 
Manual trim 


• Class B (autoland) - 

- _ Localizer track 

Glide slope track 
Flare 

Rollout guidance 

- . . Runway alignment 

Go- around guidance 




Class C (cruise and relief modes) - 
Pitch attitude hold 
Roll attitude hold 
Heading hold 
Heading select 
Localizer capture 
Vertical speed hold 
Navigation coupling 


Glideslope capture 
Altitude hold 
Altitude select 
Mach hold 
Airspeed hold 
Vertical speed select 


The Class B (autoland) functions will be designed to the safety require- 
ments of the applicable FAR paragraphs previously listed and to the safety 
requirements of: 

Advisory Circular 120- 28 A, Appendix 1, Para. 6 
Advisory Circular 20-57A, Paragraphs 5C and 5D 
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Generally, the safety design shall be such that the reliability of a. 

* -9 

catastrophic failure mode during the autoland maneuver is less than 10 from 
the minimum alert height (or minimum decision height) to touchdown /rollout. 


Maintainability 


The maintenance design of the ATT FCS has several facets. First, 
the unscheduled maintenance rate is a measure of the cost to operate the 
system. Second, the FCS must be designed for minimum scheduled main- 
tenance, ^ also a cost factor in revenue service. Finally, the capability of the 
maintenance built-in test assures the full monitoring integrity throughout the 
operating life of the airplane. 


The NASA-Langley statement of work for this study specifies the flight 
control system unscheduled maintenance rate shall not exceed 0. 02 main- 
tenance. man hours per flight hour and scheduled maintenance shall not be 
required more often than every 300 hours of flight. To ascertain the reason- 
ableness of this requirement, maintainability predictions of the, AFCS's for 
DC-10 and LlOll were analyzed. The average maintenance predictions for 
DG-10 and LlQll flight control systems are: 


• mmh 

• On-aircraft - pH ' . ~ 

. MMH 

• Off-aircraft - = 0. 02454 


Based on these predictions it is appareiit that the NASA-Langley 
of 0. 02 for an AFCS is tighter, but in the same "ball park" as that 
predicted for the DC-10 and LlOll AFCS's. 


The maintenance BIT must be designed to detect a very high percen- 
tage of faults which may occur. The maintenance BIT tests may be run 
prior to flight or during flight or, prior to use of a certain function^ such as ‘ 
a preland BIT check before use in an automatic landing. The faiilt detection 
capability of Class A and B functions rnust be greater than 99 percent to 


24 



assure the flight safety designed into the redundancy management of the sys- 
tem. The maintenance BIT must also isolate a very high percentage of 
detected faults to the line -replaceable module. This assures that maintenance 
is accomplished without costly delays and that the unconfirmed removal ratio 
remains very low. The ATT FCS is designed to fault isolate more than 95 
percent of the detected failures. 

Functional and Perfornlance Requirements 

The functional capabilities of the defined FCS are described in detail 
in Section 4, " FCS Functioha.1 Capabilities. " The FCS has been configured 
to meet the most probable performance requirements derived from the NASA- 
Langley SOW, from the airframe manufacturer's ATT reports, and from 
Honeywell's extensive design experience in the performance areas of interest. 
Thus, the FCS candidate configxirations traded off in the study would meet 
any probable set of performance requirements which would be generated at 
the time of airframe definition, and the findings of this implementation study 
should prove accurate in that time frame. 

The functional design is configxired to provide a stable airframe with 
optimized responses to pilot commands from wheels and pedals and, thus, a 
minimum pilot workload throughout the flight envelope and in all modes. The 
CCV compromises to the airframe design will be fully compensated by the 
FCS so that the flight crew will be unaware of any but optimiun handling 
qualities. The functional configuration of the ATT flight control system is 
based on the aircraft aerodynamic characteristics and the operating flight 
regimes. 

Figures 8 and 9, taken from a General Dynamics-prepared document 
show that, for cruise candidates, the ATT is statically unstable in pitch. 
Therefore, pitch-axis augmentation is required. Further, it is not unreason- 
able to assume that the aircraft is also statically unstable in the yaw axis 
(no data is given in the above-mentioned report) therefore, yaw augmentation 
is necessary. The inter-axis relationships would indicate that roll augmen- 
tation should also be provided. 
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Figure 9. - Longitudinal Short- Period Characteristics 


26 



The General Dynamics data indicates the ATT will exhibit wing 
flutter at cruising speeds with a full fuel load and at less than'400 KIAS for 
light fuel loads. To achieve safe control throughout the flight regime; flutter 
control must be provided by the minimum fUght control systenci. 

The aerodynamic data further indicate that the aircraft exhibits a' 
pronounced m'ach tuck condition at cruising speeds. Accordingly, the ,mach“ 
trim function has been included as a part of the minimum flight, contrpl system 
which must ..be operating at all times for safe control of the aircraft. , 

dompatibility Requirements, for Projected Aircraft 

The projected aircraft involves a ntunber of design considerations 
unique to the configuration. The most obvious are the number of control 
surfaces and their effectiveness, the compromises of the CCV, and necessary 
structural instability suppression. Many other requirements are also 
important in the system tailoring to the air frame: 

•, Electrical power generation 

•’ Electrical, power bus configuration 

• Hydraulic power generation 

• Hydraulic power distribution 

• Operating environment: temperature, vibration , 

• Natural hazards: EMI, lightning strike , 

The impact of the electrical and hydraulic power generation of the 
projected aircraft is of greatest significance in the various redundacy 
management arrangements and is described in Section 5, "System Definition 
and Design Process, " and Section 2, "Vehicle Definition. " 

The operating and natural hazard environments for the FCS are not 
expected to be significantly different than present-day jet transport aircraft. 
The reliability of operation in these same environments, however, is dra- 
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matically different from existing autopilots and stability augmentors because 
of the CCV/FBW function criticality. 

The operating environments for which the candidate configurations are 
designed are given in Table 1. This table lists ihe required operating ■ - 
environmental conditions, the TSO required, qualification testing procedures, 
and additions to the AS402A testing requirements which are considered " ^ 
necessary to assure the necessary hardware quality. 

The natural-hazard testing for EMI environments is also included in 
Table 1. The effects of lightning strike axe considered critical to an electri- 
cal FBW/ACT aircraft. The candidate configiirations are designed to tolerate 
the power transients of MIL-STD-704 and the conducted transient suscepti- 
bility requirements of MIL-STD-461A to assure that the signal circuits will 
be adequately protected against unexpected induced voltages from lightning 
strikes. It is also assumed that the aircraft cabling, aircraft bonding, and 
equipment bonding is in accordance with MIL-B-7087B and MIL-STD-461A. 

Because of the criticality of the FBW and ACT functions of the ATT, 
the lightning-strike hazard has a much greater significance than in contem- 
porary aircraft, and further investigation is recommended in this area. 

A discussion of the proposed investigation is given in Section 11, 
"Further Study. ” 

Mode, Status, and Crew Advisory Displays 

All FCS displays and panels with incandescent illumination will be 
controlled by a "master dim control, " and all FCS displays and panels in the 
glare- shield area will have automatic light sensing. and dimming. 

Panel and display layout and configuration are not defined, but the 
control, display, and annunciation for current commerical jet transports such 
as the DC- 10 will be included in the FCS implementation. The FCS mode 
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TABLE 1. - OPERATING ENVIRONMENTS 


■ 

l' - 

i Environmental rrequirements' . . * 

Minimum testing per FAR para 37. 119 
Automatic Pilots - TSO-C9C 
. . '(referericing/AS402A dated 2-1-59) 

Additions to TSO requirements 
for ATT AFCS 

Dielectric (individual test) 

'6. 1. 

_1 Insulation resistance 




6. 1. 

_2 Overpoiemial tests . 


3. 3. 1 

Low-temp operation 

7. 1 

5-hr + test at -30C (-22F) (controlled 
environment) or -55C (-67F) (uncontrolled 
environment). 


3.‘?/l 

High -tern proper at ion- 

7. 2 

5-hr + test at -^50C ( 1 22F) (controlled ' ' 





environment) or 70C (158F) (uncontrolled 
-environment)- ■ . 


3. 3. 1 

Extreme Temperature, Exposure 

7, 3 

24 -hr each of -65C (-85F) and 70C (158,F) 
' delay 3 Hr'and'test.at room temp. 


3. 5 

„ Magnetic effect 

7. 4 

Panel controllers only; free magnet 
"^deflection. 


3. 3/2 

, . Humidity • . / ^ : 

1 

. ■ ’ * Si . • . . 

7. 5 

One 24-hr period (controlled environment) 
or five 24-h’r periods (uncontrolled environ- 
ment); 6 hr at 70C (158F) and 957o RH, cool 
•to 38C during remaining 18 hr. 

.. .... . . . 

3. 3.3 
• / 

Vibration 

7. 6 

. , Range = ,5-500 Hz 
' > ? Max DA = 0, 036 inch 

Max Accel = lOg (wings and tail) 

.• 1 • . 5g (fuselage) 

• 3 -axis- resonant search then one hour each' 

axis at resonance; 15-min cycles for one 
hour each axis. 


3, 3.5 

I- 

Explosion 

7. 7 

Only units in nonpressurized areas of 
^aircraft. • ' 





Proven explosive mixture SL and at 
,40,000-ft. . . • •; 





Operated 10 times. 


3. 3. 6 

Ic ing * 

7. 8 

^ All' units mechanically coupled to primary 
control or trim systems; subject to 5 icing 
cycles then test performance at -55C (-67F) 

. . 

3. 3. 4 

Altitude - pressure-temp 
-1000 ft tO;40 000 ft per NACA 
Report 1235 with temperature of • 
para. 3. 3. 1 AS402A 

No testing requirements. 

Test per RTCA document DO-138 
paragraph 4. 3 (altitude) with the 
applicable altitudes'of Table 1 of 
that document. 

3.4 

Radio interference - shall be no 
interference with other a/c eqpt 
either radiation or feedback. 

No testing requirements. 

Test per RTCA document DO- 138 
with the following paragraphs. 

10, 0 Conducted voltage transient 





11. 0 Audio -conducted suscept. 

12. 0 Audio-mag field suscept. 
13,0 RF suscept., rad and cond. 

Shock 


, No testing requirements. - 

Test per RTCA document DO -138 
paragraph 6. 0 for both operational 
and crash safety shocks. 

Cooling air 

No data. 

Use cooling if necessary per ARINC 
404, 


Note: Underlined paragraph numbers are per AS402A. 
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status will be displayed; the pilot need not depend on the recognition of mode 
switch position, 

FCS mode changes not made through the normal mode switches must 
be flashing -light indication. The flashing light may be stopped with a cancel 
button. These mode changes are those caused by pilot force on the controls, 
motion of certain controls such as synchronizer wheels, and by fault detection. 
Mode selection must be nonambiguous using a mode confirmation annunciation 
as part of the operational status displays. Servo engage currents must be . . 
switched by contacts integral with the pilot-actuated lever. 

Where advisable, optimum crew action should be annunciated, espe- 
cially when faults cause reduction of FCS capabilities. This may include 
flight envelope restrictions, losses of higher-order control modes, or instruc- 
tions to land immediately for multiple FEW faults. 
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SECTION 4 

FCS FUNCTIONAL CAPABILITIES 


The primary sources for the definition of the system functional capa- 

f 

bility were the basic NASA requirements and the airframe studies performed 
by General Dynamics. The system includes stability augmentation of a stati- 
cally unstable airframe, command control of motion variables, maneuver 
load control, ride quality control, structural mode control and flutter margin 
control to the degree required by the airframe study. Further, the SOW 
requires the functions of fly-by-wire, attitude and heading control, altitude 
hold, airspeed trim hold, and coupling with various navigation and automated 
landing and takeoff systems. Other command control modes are required as 
appropriate, such as flight-path angle and velocity, altitude rate and velocity, 
and roll rate with attitude hold. Pilot interfaces to allow pilot-computer - 
control-system communication are required. 


System Modes and Functions 

The application of advanced technologies to long-range transport 
aircraft studies performed by Convair Aerospace Division of General 
Dynamics, were used to define the modes and functions. The modes and 
functions can be categorized as advanced control concepts or as conventional 
autopilot/ flight director functions. The results of the referenced studies 
indicate that several advanced control concepts may be applied to future 
transport aircraft with significant benefits. Advanced control concepts 
consist of static stability augmentation, active flutter suppression, man- 
euver load and direct lift control. These concepts were thoroughly investi- 
gated in the reference studies, with the sensor requirements and the force 
and moment producers also being defined. The advanced control concept 
configurations defined herein, with some refinements, reflect the results 
of these studies. 
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Autopilot/ flight director modes were not extensively studied in the 
referenced studies. Rather, it was felt that the modes and functions including / 
Category III autoland, available in today's modern transports (DC-10, L-1011), 
are adequate for the 1975-1985 time period. The autopilot/flight director . 
modes can be categorized as command control modes, outer -loop modes 
(inertial and air data), and coupled command modes. These modes and their 
functions are: 

• Command control modes — 

Control wheel steering (rate commands) 

Override or supervisory override of O/L modes 
Turn control 

• Outer-loop modes (inertial and air data) — 

Attitude hold 
Heading hold 
Altitude hold 

Altitude select " 

Vertical speed hold and select ' ' 

Heading select 

Mach hold ' 

- IAS hold 

Flare . ; v 

• Coupled commands 

! V .! ..‘■'.-.If 

Radio navigation (VOR) 

ILS — ■ localizer /glide slope /aline /rollout 

- MLS ^ 

Area navigation ^ 

Terminal air traffic cpntrol ^ . 

- Inertial navigation ^ 


^ Provisions for coupled signals equivalent to steering commands are 
included in the baseline implementations. 
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Flight director modes are included above and on the functional block 
diagrams; however, the flight director displays and driving electronics were 
not included as a part of the baseline candidate configurations. Hardware- 
mechanization of the autothrottle function also was not performed as a part of 
thisstudy. 

The basic single-thread baseline functional system, including sensors, 
panels, actuators, and computation is shown in Figure 10, Signal flow 
between the various subsystems is indicated in this diagram. System desript- 
ions and related functional block diagrams that formed the basis of the trade- 
off studies are provided in the following subsections. 


Relaxed Static Stability, Mach Trim System 

The relaxed static stability, mach trim system block diagram is shown 
in Figure 11. Pitch rate from a fuselage -mounted rate gyro, is fed into a lag 
network. Scheduling of the lag time constant with static pressure and dynamic 
pressure is done to match the time constant with the aircraft time constant. 
Loop gain is also scheduled with the same two parameters. 

When in the direct-link or CAS modes, the mach trim system is oper- 
ative. Mach trim is required in the transonic region to stabilize the unstable 
trim characteristic. This input is synchronized in all other modes. 

Flutter Suppression System 

Figure 12 shows the flutter suppression system assumed for the trade- 
off studies. Right and left wingtip rate gyros measure symmetric torsion. 

The rigid-body component is subtracted out using a fuselage-mounted gyro. 
This signal then drives the outboard aileron to damp the symmetric wing 
torsion. 
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Figure 10. - Baseline System Functional Block Diagram 
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Figure 12. - Flutter Suppression System Functional Block Diagram 




Symmetric wingtip acceleration is measured by right and left wingtip 
accelerometers and a fuselage accelerometer. These signals are shaped 
and gain scheduled before driving the wingtip surface. This signal also 
drives the outboard aileron through a scheduled gain. 


Manuever and Gust Load Alleviation System • 

The maneuver and gust load alleviation system uses a complement of 
sensors that include wingtip and midspan -accelerometers, a fuselage rate 
gyro, and wheel-force transducers to drive the stabilizer, outboard spoilers 
and outboard ailerons. Figure 13 shows the functional block diagram. Gains 
to all three surfaces are scheduled as a function of dynamic pressure. , A 
crossfeed from the spoilers and aileron to the stabilizer cancels pitching 
moments from these surfaces. The spoilers are operated from the faired 
position providing gust alleviation in one direction, whereas the ailerons 
prpvide alleviation in both directions. 

The ATT study conducted by General-Dynamics indicated tha:t the 
improvements in ride quality and fatigue life resulting from incorporation 
of a full-time gust alleviation system did not justify including this feature. 

The scope of this Honeywell study did not permit a determination of the 
applicability of the mode. The midspan accelerometers shown in Figure 13 
were, consequently, not included in the candidate configuration mechaniza- 
tions because of their limited and questionable application. The computational 
requirements of the mode were included, however. 

Direct Lift Control ’ 

In tjie. autoland, glide slope error, normal acceleration, radio- altitude 
and pitch'attitude drive uprigged midspan spoilers. The elevation is driven 
by the same signal to cancel the pitching moments due to spoiler deflection. 
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Figure 13. - Maneuver and Gust Load Alleviation System Functional Block Diagram 



















Yaw -Axis Control 


The yaw-axis stability augmentation system (SAS) and autopilot func- 
tional block diagram is shown in Figure 14. 

Yaw SAS. - The yaw SAS provides both damping of the dutch roll mode 
and turn coordination during manual and automatic control. Yaw rate is 
modified by a scheduled gain and passed through a washout to remove the 
effects of steady-state turns. The signal is summed with lateral acceleration 
having filtering and gain scheduling, A flap-position sensor provides the dis- 
crimination for low-speed/high-speed control law switching. The high-speed 
yaw SAS control law is modified for slow-speed, lowered-flap conditions by 
summing yaw rate directly with the shaped roll -attitude twin coordination 
signal and blending the results with lateral acceleration. The SAS control law 
switching is required to compensate for the reduced effectiveness of the 
lateral acceleration turn. 

Yaw autopilot. - The yaw-axis autopilot provides the forward slip 
maneuver and is engaged at the appropriate altitude determined by the radio 
altimeter signal. Localizer beam deviation and acceleration blended with 
course error signals augmented by yaw rate are used to provide rudder com- 
mands for forward-slip runway alignment maneuvers. Lateral acceleration 
is fed through a deadband to bias the bank command in such a manner that 
approaches in exceptionally large cross winds result in a partially banked and 
a partially crabbed maneuver. 

The roll-out mode is initiated at touchdown. The same control is used 
during the forward-slip maneuver except that a washout function is switched 
into the course error computation. Proportional -plus -integral control is used 
for these two modes. 
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Pitch-Axis Control 


• . • The pitch-axis functional block diagrana (Figure 15) shows that the 
pitch axis is functionally divided into three parts --pitch command augmenta- 
tion system (CAS), pitch enroute coupler, and pitch ILS approach/land coupler. 

Pitch CAS. - The pitch command augmentation system is the basic 
mode for manually commanding pitch-attitude changes. Either the . pilot or the 
first officer can change the pitch attitude by commanding aircraft pitch rate 
proportional to the control column force. If the wheel forces do not exceed a 
set level, high-passed pitch rate is fed to the elevator. Manual trim capa- 
bility is provided through the control wheel trim switches. 

Pitch enroute coupler . - Included in the pitch enroute coupler discus- 
sion are the following modes and functions: 

• Pitch attitude hold 

• Pitch control wheel steering 

• Altitude hold 

• Altitude preselect 

• IAS hold 

• Mach hold 

.• Vertical speed hold and select 

Pitch attitude hold: The pitch attitude-hold mode is the basic pitch- 
axis mode for both flight director and autopilot. The autopilot attitude control 
is achieved by synchronization of the attitude occurring at mode engagement if 
the aircraft is at an attitude less than a maximum limit value. If the mode is 
enaged with the aircraft in an attitude above the limit vadue, the aircraft is 
returned to the limit value, and that attitude is maintained. 

This method of autopilot control is accomplished by the use of attitude 
sjmchronization. During CAS or CWS maneuvering, the pitch-attitude 
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synchronizer is following the aircraft attitude. Upon autopilot engagement or 
release of CWS forces, the synchronizer is locked, and the attitude existing 
at that time will be held. By limiting the followup to the required limit values, 
the aircraft will return to the limit value and hold that attitude upon mode 
engagement. . , ' 

Proportional -plus-integral control on attitude error is provided, 
Adjustments of the attitude reference when going to CWS can also be made. 

Pitch control wheel steering; The pitch control wheel steering mode 
of operation is the basic autopilot nriode for manually commanding pitch- 
attitude changes. Either the pilot or the first officer can change the aircraft 
pitch attitude by commanding aircraft pitch rate proportional to the control 
column force. The mode is automatically engaged whenever the control 
column force exceeds a threshold level. The threshold level is required to 
alleviate nuisance engagements of the pitch CWS mode when the pilot is resting 
his hands on the control wheel or using the control wheel for steering in the 
lateral axis. When the CWS mode is engaged, the pitch attitude is synchro- 
nized. When the forces are reduced below the threshold level, the CWS mode 
is automatically disengaged, and the pitch attitude previously described is 
engaged. 

Altitude hold; The altitude -hold mode of pitch control retains the alti- 
tude existing at the moment of mode initiation through the use of a synchro- 
nized altitude signal as the control reference. Blended barometric altitude 
rate is also used for stability and improved short-term or transient control. 
Normal control wheel steering operation is inhibited during automatic altitude 
hold. However, control wheel forces greater than the high-level override will 
disengage the mode. Integral control is provided on the altitude. 

Altitude preselect; Altitude preselect is another pitch-control mOde 
that is functionally the same for either autopilot or flight director operation. 
The mode is engaged, and the desired altitude is manually preselected. 
Initiation of the mode on the control panel places the autopilot in the arm 
phase. Maneuvering to the selected altitude is accomplished by control wheel 
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steering or any other pitch mode. When the altitude error is equal to a pre- 
determined altitude' rate, the capture phase is automatically initiated, and the 
previously selected mode is disengaged. 

: The- selected altitude is then automatically captured in an exponential 
flareout maneuver. When the altitude error gets to be less than some pre- 
determined value, the altitude -preselect mode is automatically disengaged and 
the altitude -hold mode engaged. The latter mode is then maintained until 
manually disengaged by the pilot or first officer. Signal shaping, gain 
scheduling and proportional -plus-integral control are used to achieve precise 
altitude capture throughout the flight regime. 

, IAS hold: The lAS-hold is similar to the altitude-hold mode of opera- 
tion. The control principle of the mode is to retain the IAS value existing at 
the instant of mode engagement. Like altitude, a synchronized IAS reference 
is' used.; Engagement of the mode can only be accomplished by manual initia- 
tion of the mode-select button on the integrated control panel. Proportional.- 
plus-integrated control is used for static accuracy. To change the LAS-hold 
value, the mode has to be disengaged, the airspeed modified, and the mode ' 
re-engaged. < 

Mach hold: The mach-hold mode of control is functionally identical to 
LAS hold. . Engagement of the mode, causes the autopilot or flight director 
command bar to maintain the mach number existing at mode initiation. The 
reference, mach. signal is a synchronized mach output. The mode is engaged 
by initiation of the select button on the panel and disengaged by selecting any 
other pitch mode or applying a control column force greater than the high- 
level override value. Like LAS hold, normal CWS is inhibited at mode engage- 
ment. Proportional -plus-integral control is used for static accuracy. To 
change the mach reference, the mode has. to be disengaged, the mach modified 
and the mode re-engaged. 

Vertical speed hold and select: In the autopilot vertical speed mode, 
the aircraft pitch attitude is adjusted to maintain the commanded vertical 
speed. The commanded vertical speed is derived from the vertical -speed 
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control on the. control, panel which is referenced to the altitude-rate signal. 
Prior, to engagement, the vertical -speed control is synchronized to the exist- 
ing altitude rate. 

The ;vertical .speed at mode engagement is.referenced vertical speed. 
Rotation of the. vertical -speed control on the control panel will select a new ■ 
value: of verticsil speed. 

Pitch ILS approach/land coupler . - Two functions are discussed: 
ILS-MLS approach control and go-around control. 

ILS-MLS approach: During the arm phase of this control, any other 
verticalrpath mode can be used for approaching the glideslope beam except 
altitude preselect. When the glidepath signal from the VHP receiver has - 
decreased to the designated capture level, the capture phase is automatically 
initiated, and the vertical-path mode used during approach is disengaged. The 
capture phase of. control employs glideslope beam error augmented with a ^ 
blended altitude rate. By using a bleedoff synchronizer on the glideslope 
error, the capture maneuver is a smooth exponential maneuver regardless of 
the flight path prior to engage. When the beam error is less than the designa- 
ted capture level, the ILS approach track phase is automatically initiated. By 
use of a limiter- summing technique, the glideslope control law is blended into 
flare -.control without the requirement for mode switching. The outputs of a 
radio altimeter, and a normal accelerometer are combined to obtain a blended 
altitude rate signal.- Pitch attitude is also used to provide additional damping. 
Proportional-plus-integral control is used on the error signal to ensure pre-' 
cise tracking. . In addition to driving the elevator and flight director, a com- 
mand drives up-rigged spoilers for direct lift control. 

Go-around: The purpose, of the go-around is to quickly arrest the 
initial descent and to establish the aircraft on a satisfactory climbout path. 

It is designed for a complete range of initial flight situations in terms of 
descent rate, airspeed, and aircraft configurations. 
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The basis of the go-around design approach (Figure 16) is an angle-of- 
attack command which is a function of vertical speed, forward acceleration, 
and flap angle. The total command is limited to maintain a desired margin to 
the stalTwarning value. 

The h-shaping is scheduled such that the a “command decreases as h 
increases. As a result, the maximum permissible a is commanded during 
the descent, giving a high-normal acceleration. 

The a “Command is also modified by forward acceleration. If u is 
positive, the a command is increased, and vice versa. At positive ii, some 
of the available power is thereby diverted to assist the gain in height. At 
negative u, the consequent decrease of the a command assists the h-shaping 
in preventing an excessive dynamic climb, during which a not unsafe, but 
unnecessarily large, amount of speed might temporarily be lost. An impor- 
tant function of the u-term is to augment long-period stability. 

The control includes an open-loop, nose-up command which is injected 
on engagement of the go-around. It assists the arrest of the initial descent 
but does not affect the course of events in the long term. 

Angle -of- attack sensors were not included as a part of the flight con- 
trol system mechanization. It was assumed that angle -of- attack signals would 
be available from the stall warning subsystem included as a part of an auto- 
matic throttle system. 


Roll -Axis Control 

The roll -axis functional block diagram (Figure 17) shows that the roll 
axis is functionally divided into three parts-- roll CAS, lateral enroute 
coupler and lateral landing coupler. 

Roll CAS . - The roll command augmentation system is the basic mode 
for manually commanding roll-attitude changes. Attitude changes are made 
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Figure 16 , Go-Around Control System Functional Block Diagram 




































by commanding roll rate proportional to control wheel force. The wheel force 
must exceed a specified value before the command is effective. A lag fUter 
on roll rate attenuates structural coupling. 

Lateral enroute coupler. - Included in the lateral enroute coupler dis- 
cussion are the following modes and functions: 

• Roll attitude hold 

• Control wheel steering 

• Heading hold 

• Heading select 

• VOR navigation beam guidance 

• Auxiliary navigation 

Roll attitude hold: The roll attitude -hold mode is the basic mode of 
control of the roll autopilot. During pre-engage or CWS maneuvering, the 
aircraft roll attitude is synchronized. 

At autopilot engagement or release of CWS forces, the roll attitude at 
that time will be the reference. By limiting the maximum reference values, 
the aircraft will roll back to this value when engaged at a larger value. 

Control wheel steering: The roll control wheel steering mode is the 
basic roll autopilot mode for commanding manual roll-attitude changes. The 
mode is automatically engaged whenever the control wheel forces exceed the 
threshold, and the autopilot is engaged. When the forces on the control wheels 
are below the threshold value, the CWS mode is automatically disengaged, and 
roll attitude hold or heading hold is engaged as a function of bank. 

Heading hold: The heading-hold mode in conjunction with roll attitude 
hold is the basic mode of control for the roll autopilot. The flight director 
mode with the autopilot in heading hold is wings-level. The heading-hold 
reference is a clutched synchro signal from the compass system. For the 
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autopilot, proportional -plus -integral control provides tight heading hold with 
no steady-state offset. Gain scheduling with airspeed results in optimum con- 
trol at all flight conditions. Heading hold will engage only when bank angle, is 
within certain specified values. 

The heading-hold mode will disengage if CWS forces exceed the thres- 
hold, .any other lateral -directional mode is manually engaged, or the capture 
phase of the directional modes are initiated. As with all clutched signals^ 
engage and disengage operation normally occurs at or near zero, and no ■, 
special transient alleviation considerations have been incorporated in the: mode 
switching. 

Heading select: The heading-select mode is both a flight director .and 
autopilot mode: of operation. If either autopilot-engage lever is in the 
COMMAND position, the aircraft will be smoothly maneuvered to the heading 
set on the heading-select readout. It will then capture and maintain this • 
selected heading until the mode is disengaged or a new heading is selected. 

The maneuver during the capture will be limited in bank angle and bank angle 
rate. 

Long-term integration is provided during the "hold" phase to improve 
the^heading track operation. This is automatically engaged whenever the . 
heading error is reduced to a set value. 

i 

Selection of another lateral mode or a directional mode with the radio 
beam captured will automatically disengage the heading select mode. 

VOR navigation beam guidance: The VOR mode provides autopilot 
and/or flight director capture and track of a VOR radio reference. Prior to 
use, the proper radio frequency and course have to be selected on the appli- 
cable selector on the navigational modxile of the control panel. Beam approach 
can be made in any of the other lateral directional modes or CWS. At beam 
interception (beam error is less than 6. 5 deg), the approach mode is dis- 
engaged, and beam capture and track follows. The particular blend of beam 
error and course used in this control law results in good beam capture from 
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virtually any relative heading, followed by a smooth transition from a capture 
to a tight track phase. Also included in the control sensing and logic is auto- 
matic over station switching. When the logic senses proximity to the trans- 
mitting station, the beam error is cut out to avoid the "zone of confusion" 
while the aircraft maintains the selected course heading. Upon leaving the 
overstation area, the mode is automatically re-engaged in the track phase. 
Autopilot maneuvering during the capture phase is limited to bank angle and 
bank-angle rate. During the track phase, these limits are reduced. The 
flight director command is limited to the same bank-angle values during 
-manual operation.- 

As previously indicated, interception of the VOR beam can be made 
using heading- select, heading-hold, or CWS lateral -directional modes of 
operation. All modes used for the intercept will be automatically disengaged 
at initiation of the capture phase except for CWS. The CWS mode can also be 
used in a supervisory override mode during the automatic capture phase. It 
is automatically disengaged at the initiation of the track phase. 

Auxiliary navigation: This lateral navigational mode will use either 
inertial navigation or doppler radar as the control reference. Essentially the 
same control laws and bank limits will be used for capturing and tracking the 
reference as are used for VOR operation. Of course, the over station logic 
will not be required for this mode. The mode is disengaged by the selection 
of another lateral mode. 

Lateral landing coupler. - Two functions are discussed; LOC naviga- 
tion beam guidance and roll go-around control. 

LOC navigation beam guidance (VOR /LOC or ILS); In this mode of 
operation, the autopilot or flight director display commands capture and track 
the ILS localizer beam. The mode is initiated by selecting the applicable 
navigational radio frequency and course and then pressing the VOR/LOC or 
ILS pushbuttons. Initial mode engagement is in an arm phase in which the 
heading-hold, heading-select or CWS modes of operation can be used to inter- 
cept the localizer beam. When the beam error is less than 2.5 deg, the 
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capture phase is automatically initiated. As in VOR, the beam-error and 
course-error signals are blended to give a variable -angle capture which per- 
mits approaching the beam from virtually any relative heading. At initiation 
of the capture phase, the heading modes used for the intercept will be auto- 
matically disengaged. If CWS has been engaged, it will remain in effect 
throughout the capture phase for use as supervisory override. It will be 
automatically disengaged at the initiation of the LOC track phase. The LOC _ 
track phase is automatically initiated when beam error, course error, and 
bank angle are less than specified values. 

Proportional beam and course error are used to perform smooth beam 
captures from virtually all angles, with no overshoots and the aircraft always 
turning towards the runway. When the LOC track-sensing logic is satisfied 
as described above, the control is changed to beam error and washed-out . 
course error. At touchdown, the outer-loop commands are removed, and the 
ailerons maintain wings-level during the rollout phase of control. 

Roll go-around: The roll go-around mode is inhibited until the glide- 
path is captured. After initiation of the glideslope track phase, the go-around 
mode can be engaged. During this go-around mode, the roll control is essen- 
tially the same as the localizer approach track control with continued use of 
proportional-plus-integral beam error and lagged roll attitude augmented by 
lateral acceleration and yaw rate. The only major difference is that the roll 
maneuver limits are reduced. As the aircraft approaches the localizer trans- 
mitter, the localizer beam guidance signal is removed, and the aircraft con- 
tinues the go-around, maintaining course (runway) heading. 
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SECTION 5 

SYSTEM DEFINITION AND DESIGN PROCESS 


The schedule and magnitude of this study did not permit detailed per- 
formance of all of the steps in the normal design process, however, they 
have been carried out to the extent necessary to present meaningful tradeoffs 
of the various candidate configurations. 

Since the study is concerned primarily with digital mechanizations, 
the following basic steps for the design and mechanization of a digital flight 
control system were followed: 

• Define FCS requirements 

• Prepare functional block diagrams 

• Define analytical requirements (transfer functions) 

• Determine redundancy approach 

• Define discrete difference equations 

• Conduct digitization process (compute scaling, word length and 

iteration frequencies) 

• Define computer (concept, speed, memory size) 

• Define hardware 

The first three steps are applicable to both analog and digital configu- 
rations and have been covered in the previous sections. The succeeding 
steps in the digital design process are briefly discussed here. 

Redundancy 

Redundant copies, or channels as they are frequently called, can be 
configured as either independent channels or cross-strapped. "Independent 
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channels" indicates that there is no interconnection or sharing of control sig- 
nals between the parallel channels. Cross-strapped means that there are 
interconnections and signal sharing between the redundant channels. Cross- 
strapping may be accomplished either by analog crossfeed or intercommuni- 
cation between processors. Cross-strapping may be used at both the input 
(sensor signals) and output (servo drive) of the processors or at either point 
individually. 

Redundant organizations can be operated either in an active or an 
antive- standby mode. In the active mode all redundant channels are affecting 
system responses simultaneously. In the active -stand by mode. Some of the 
channels are controlling the system while the others are standing by, ready 
to assume control in the event one of the controlling elements experiences a 
fault. 


The reliability and fault tolerance of the SAS/FBW portion of flight 
control systems are more severe than those for outer-loop modes. In fact, 
a total failure of a pilot relief mode would, at worst, result in an increase in 
pilot workload. A failure in the FBW portion, on the other hand, would en- 
danger the flight schedule if not the airplane. It was previously pointed out 
that reliability and fault tolerance are closely related to redundancy. It is 
conceivable that simplex, or nonredundant, outer-loop mechanizations of 
some functions are adequate in a configuration that requires high levels of 
redundancy for inner-loop (SAS/FBW) functions. Configurations of this 
nature would be desirable in the event that inclusion of the noncritical outer- 
loop functions in the inner-loop computations, overburdened otherwise ade- 
quate machines. Dual levels of redundancy would permit using N + 1 smaller, 
less powerful computers instead of N larger machines in order to provide the 
N levels of redundancy required of the inner loops. Whether N + 1 smaller 
machines are more advantageous than N larger machines is dependent upon 
the specific situation. The question cannot be answered in general. 

United Air Lines, in an unpublished report assessing the application 
of advanced technologies to subsonic CTOL transport aircraft, indicates as 
acceptable, a configuration which would allow dispatch with one channel 
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inoperative and accommodate a second failure in-flight in a "fail operative" 
mode. The studies reported in references 3 and 4 are also in general agree- 
nient with such a concept. This two-fail-operative criteria has been used in 
defining the redundancy level to be applied in the candidate configurations. 

A redundant system that is required to provide undegraded performance 
after N identical failures must, as a minimum, have N + M copies of each 
element that could fail. It is rather obvious the M > 1. If each copy within 
a redundant configuration is capable of determining its own fault status auto- 
nomously, or if there is no protection required in the event of a subsequent 
failure, M = 1. Otherwise, M > 2. In this context, the term "autonomous" 
is taken to mean "without reference to any other device. " 

In the redundancy equation defined above -- 

N = 2 

. / 

For systems with autonomous fault detection — 

M = 1 and N + M = 3 channels 

For systems without autonomous fault detection: 

M = 2 and N + M = 4 channels 

From the foregoing discussion, it is apparent that the fault detection 
methods used are a primary factor in establishing the redundancy concepts 
to be applied. The following two paragraphs are concerned with the prelimi- 
nary tradeoffs involving fault detection which affected the candidate configu- 
rations. 

Comparison fault detection. - The only information that can be deter- 
mined by comparison of two identical controllers is that one of them is at 
fault. This, of course, utilizes the single-fault assumption; i. e, , no two 


55 



failures will occur simultaneously. In order to determine which of the two 
channels is at fault it is necessary to resort to an arbitrator. The simplest 
and most straightforward way of obtaining an arbitrator is to simply add 
another channel and make a three-way comparison. A failure of channel "C" 
is indicated if a three-way comparison is made among channels A, B and C, 
with A and B agreeing while A and C and B and C disagree. 

The channels can either be comparison monitored in the analog domain 
or in the digital domain. In many respects, the digital approach is the most 
attractive even though it requires that some alternate method be utilized to 
monitor the D/A converters at the output. A straightforward approach to 
handling this is the wrap-around method wherein the analog output of the 
D/A converters are treated as though they were analog input signals as well. 
The analog output voltages are converted back into their digital equivalents 
via the A/D converters at the input and are compared to their required values 
digitally. 

The digital comparisons on the output of the channels can be either 
bit-by-bit, or differential. Bit-by-bit comparisons are predicated on the 
assumption that the outputs will be in agreement except in the case of a fault. 

Differential comparisons, on the other hand, do not require perfect 
agreement between the channels but instead permit a certain amount of skew. 
This method does not work well if there are integrations in the loop. Digital 
integrations, unlike their analog counterparts, are drift free. Theyp,do not 
tend to bleed to zero with time. Therefore, digital integration with close but 
nonidentical inputs will eventually have enough skew in the outputs to exceed 
any usable differential threshold. Most flight controllers have at least one 
integrator, which necessitates their having identical, inputs. With identical 
inputs the differential reduces to zero, which permits either a bit-by-bit or 
a differential comparison. Bit-by-bit comparisons are less complex than 
differential comparison and are preferred for that reason. 
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Bit-by-bit comparators are very simple if the channels are run in bit 
synch with identical inputs and initial conditions. This is because the compara- 
tors, which are nothing more than majority (2 of 3) voters, operate' on the 
outputs in a serial fashion. The bits are compared as they are outputted 
serially rather than en masse on the whole digital word as would be the case 
with parallel comparators or differential detectors. 

There are several techniques available for ensuring that all channels 
have identical inputs even though the sensors have non-identical outputs due 
to skew and tolerance effects. The method that is best suited to this configu- 
ration, since it can be serially and in a single pass, is median selection. 

Autonomous fault detection (in-line monitoring). - Tracer monitoring 
is a fault detection technique that provides autonomous fault detection. In 
analog systems, tracer monitoring is usually embodied as a high frequency 
(i. e. , well beyond the control frequency range) tracer signal that is injected 
at the input to the device or circuit. This technique has been successfully 
used with both accelerometers and gyros (in the Dyna-Soar FCS) to provide 
in-line monitoring of the signal pickoff portions of these sensors. Spinmotor 
rotation detectors of various types have been utilized to assure proper gyro 
spinmotor operation. Gimbal freedom of both gyros and accelerometers has 
been determined by including torquers which are "tweaked" at intervals, 
while normal system operation is discontinued, to produce a predetermined 
test output. Such techniques may be used with virtually every type of sensor 
to provide an autonomous fault detection capability. The principal negative 
aspect to using these techniques is the increased cost. 

The tracer monitoring technique may also be used to monitor an 
analog controller. The tracer signal will undergo a certain amount of 
attenuation and phase shift as it passes through the analog controller. This 
attenuation and phase shift can be calculated for a given set of gain conditions. 

The integrity of the controller will determine the characteristics of 
the tracer signal at the output. If the tracer has the proper gain and phase 
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characteristics at the output, the controller is operating staisfactorily; . ^ 
otherwise, a fault condition is indicated. 

The technique has never been successfully used to test an entire 
analog controller even though it is theoretically sound and has been used to 
test portions of an analog controller. The reason is twofold: 

• Gain and time constant scheduling as a function of flight condition . 

• Lag circuits ■ ' - 

Time constant scheduling is occasionally required even though gain 
scheduling is by far the most common and easiest to deal with. Scheduling 
can be either a step function or a continuous change. In either event, the 
tracer signal detector on the output has to have its go/no-go criteria adjusted 
according to the same parameters. The detector scheduling information should 
be acquired independently of that for the controller; otherwise, certain 
failures in that portion of the system would result in an undetected fault.'- 
Some replicated hardware would no doubt be required to furnish this inde- 
pendence. 

The lag circuits that are generally prevalent in autopilots are "shorts" 
to ground for high frequencies. The tracer signal is essentially lost each 
time a lag circuit is encountered. In order to circumvent this, it is necessary 
to check the tracer at the lag circuit and reinsert it downstream. This 
requires several additional detectors and signal inserters and fails' '^o meet 
the objective of providing an end-to-end test. 

While neither of these problems, either singly or together, present 
insurmountable' obstacles, they have been sufficient to discourage wholesale 
application of tracer monitoring to an entire analog controller. Duplication 
of soriie or all of the circuitry with comparison monitoring to determine and 
identify faults is the usual technique that is employed, 

Digital controllers, on the other hand, are quite capable of autonomous 
fault detection.' This is due primarily to two things: The digital computer's 
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ability to "wear different hats" as a function of time, and the decision-making 
capability of the computer. 

The ability of the computer to "wear different hats" arises from the 
time -^sharing nature of general-purpose machines. The arithmetic and logic-, 
unit (ALU) performs all of the various arithmetic and logical functions under, 
control of the program memory. At one instant the ALU will be computing a 
particular control law; the next instant it could be computing a different control 
law, or performing some test on an input or output signal, even testing itself, 
depending upon what the program calls for at that moment. 

Autonomous fault detection capability throughout the flight control 
system would provide two-fail-operational performance with only three 
identical channels. The possible cost savings in comparison with a quadruple^ 
cha.nnel configuration are readily apparent and it is obvious that the triple 
channel in-line monitored configuration must be given serious consideration. 
Accordingly, seven of the candidate configurations were structured as triple 
channel in-line monitored systems in order that the benefits and disadvantages 
of this less complex implementation would become evident in the cost of 
ownership tradeoff. 

The consensus of airline management and aircraft manufacturers 
(evidenced in informal discussions) is that a quadruple- redundant majority- 
voting FEW control system is the minimum acceptable at present. Although 
not specifically stated, there appears to be a general distrust of self-moni- 
toring concepts. This attitude is undoubtedly due to the complete absence of 
commercially available proven self-monitored sensors and, despite the 
theoretical proofs, failure to demonstrate 100 percent autonomous fault- 
detection capability of a digital computer. Consequently, the lack of confi- 
dence in triple- redundant in-line monitored configurations indicates a risk 
factor which must be included in the tradeoff. This was accomplished in the 
dispatch philosophy described in Section 8, 

In-line monitoring of servo actuators is relatively easily accomplished 
since the input, output and the dynamic response characteristic of a specific 
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actuator can be well defined. The 100 percent detection of faulty operation in 
this case is assured by the availability of servo rate and position transducers 
and hydraulic pressure differential, detec tors associated with each actuator. 
This capability of autonomous fault detection in the servo actuator area is 
generally recognized, and, inasmuch as changing the level of redundancy 
poses no serious problems, triple-redundant actuators should be considered 
as a viable alternate element in any configuration. 

A discussion of other factors introduced by redundant configurations, 
such as summing and cross -strapping, is most easily accomplished with ,, , 
reference to the analog servo actuators, as in the next paragraph. 

Position- versus force~summed servos. - In force- summed install- 
ations the outputs of the redundant actuators are rigidly connected together. 
The output position will be that at which force equilibrium is established. ,It 
is not possible for each channel of a practical controller in a redundant 
organization to reach its own exact equilibrium due to system tolerances and 
mistracking among the redundant elements without resorting to some, sort of 
an artifice. K an artifice is not used, the resulting force fight will create a 
"soft" equilibrium with nothing left for the load. Two of the more common 
artifices are: . .. 

• Use the integral of the differential pressure, in each cylinder as a 

feedback term to cancel tolerance effects between the redundant 
copies. ,. 

• Use a master- slave arrangement where one output will prevail and 
the others will track it. This amounts to the above method if the 
differential pressure feedback is omitted in the master. 

Position summing is achieved by whippletrees for dual servoes and 
wobble plates for triplex and beyond. The resulting output position will be 
the average of all the individual outputs. This type of arrangernent does not 
need an artifice to compensate for tolerances. 
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Force summing has a definite advantage over position summing in 
that an abrupt "hardover" failure of one channel cannot propagate to' the output 
if there are at least three actuators in the summation. There will be a 
significant reduction in the load torque that is available, but a proper design 
will allow for this. ' This type of failure will alter the average in a position- ’ 
summed arrangement and will thus be propagated to the output. 

The faulty actuator should be neutralized in a force-summed arrange- 
ment when a failure'occurs. In the case of a hydraulic servo, this would 
simply andbunt to removing its source of pressurized oil and changing the 
designation of the' master in the event that the master failed in a master- 
slave configuration. 

The defective actuator should be centered; i. e. , it should be locked 
into its midpoint position when a failure occurs in a position- summing 
arrangement. A suitable gain change' should then be made in the remaining 
channels Ho ensure that the average position will still- be the correct position 
even though the contribution of one of the elements is permanently set to zero. 

As fair as redundancy requirements are concerned, it is obvious that 
three channels are sufficient to survive a failure and produce undegraded 
performance in a force-summed situation -- one to experience the failure, 
and two to' overcome its undesirable effects. This will require that the 
defective Servo be neutralized as soon as possible. An extra channel, with 
the ability to neutralize it, must be added for each additional failure that 
must be tolerated. A quadruplex force -summed servo would yield the ability 
to provide undegraded performance after two identical failures. 

A dual configuration with suitable centering and gain changing devices 
will allow a position-summed servo to provide undegraded performance after 
a single failure. Triplex redundancy will be adequate to ensure undegraded 
performance in the presence of two identical failures. 

A further discussion of actuator tradeoffs is included in Section 6. 
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Cross-strapped digital controllers. - Figure 18 illustrates the two 
methods of cross -strapping — analog crossfeed and processor intercommuni- 
cation. The analog crossfeed method provides more success paths at the 
expense of more interconnecting wires, input buffers and analog-to-digital 
conversion. Both methods use some form of optimum signal selection of the 
control signal. 

Cross -strapped controllers that use median selection algorithms to 
obtain the control signal,behave for the most part like force-summed servos. 

As a minimum, three channels of the controller are required for the concept 
of median selection to make sense. The major flaw with median selectors is 
the transient that occurs should the source of the median signal suddenly fail. 
The median selector will immediately switch to another source. This switching 
action will allow a transient to occur. The size of the transient will depend 
upon how far the new median is from the old median. 

It is possible to minimize the size of the transient, if not eliminate it 
entirely, by using equalization similar to that required for force-summed 
servos. The difference between a particular sensor's value and the median 
value is used as a feedback term to cancel out skew and tolerance effects. 

It takes three channels for the median selector, first of all, to compute a 
median and then to find the new median in the event of a failure. The median 
selector cannot detect a failure. 

There is no clearcut directive as to what should be done about the 
defective signal when a failure occurs. A primary consideration is whether 
it should be switched out. If it is switched out, a strategy must be imple- 
mented to ensure that three or more inputs remain. If it is to remain as an 
input a decision must be made as to whether the signal should assume any 
value it wants, or whether it should be forced to a particular value and what 
this particular value should be. If it is forced to an extreme value, a sub- 
sequent failure can result in the faulty signal being selected as the median. 

If it is forced to zero, the small signal behavior in the remaining controllers 
may be erroneous. In general, the decisions made in the above considerations 
will be dependent upon the application and the user's priorities. 
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(a) Basic Quadruplex System 


► AWAtOf. signals 




(b) Basic Quadruplex System with 
Sensors Cross-Strapped 


(c) Basic Quadruplex System with 
Multiplexed Data Bus 
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Figure 18. - Analog Crossfeed and Processor Intercommunication 

Cross-Strapping Methods 
















































. As indicted previously, median selection cross -strapping requires a 
minimum of three channels to survive a failure in one controller and provide 
undegraded performance. A minimum of four channels is required to survive 
two failures. There, is no median as such of four signals. What is usually 
done is to take either the more negative or more positive of the two inner 
signals. An alternative would be to operate in an active -standby mode until 
the first failure .occurs. 

..Another method that is commonly used to develop the control signal in 
cross-strapped controllers is an averaging. crossfeed. In this method,, each 
channel accepts inputs from all other channels and computes their average, 
which is then used :,as the signal. This is roughly analogous to positionr 
summed servos. A failure transient will be propagated to the output should 
one of the signal sources suddenly change values. The defective controller 
.must then be neutralized and suitable gain changes .made to take up the slack. 
Only two channels would be required to provide undegraded performance after 
a .signal failure . if autonomous fault-detection techniques are utilized. A 
third channel would allow two failures. An additional channel, bringing the 
count to 3 and 4, respectively, would be required if comparison monitoring 
were used for fault detection. 

Certain classes of digital controllers develop the Control signal in 
yet a third way. In this method the channels are interconnected, and the 
resulting signal is derived from a majority vote of all inputs on a bit-by-bit 
basis. The, digital signals bits can only have two values: either a one, or, a 
zero. ,,, No other values exist. 

To use this method, certain criteria must be satisfied: 

• There must be at least three channels in order to get a 2 of 3 
.. (four for a 3 of 4). 

• In the absence of failures, all output must normally' agree on a bit-b'y- 
bit basis. 
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The redundant channels must operate in time synchronism to some 

extent to' facilitate bit-by-bit voting. 

This method is complfetely analogous to force -summed servos. 

Faulty signals (bits) are completely suppressed. 

The corrective action that should be taken when a failure occurs is 
not clearcut. Something must be done to ensure that at least three signals 
remain if the defective signal source is switched out. If it is allowed to 
remain as an input, what value should it be allowed (or forced) to assume? 

A one or a zero? Three channels allow two failures. With four channels 
the defective channel can be switched out after a single failure, or the four 
channels can be operated in an active -standby mode. • ' 

I ... • . . . 

Non-cross-strapped digital controllers. - Failures in a' single-channel 
controller configuration propagate immediately to the servos and behave 
exactly like servo failures. The discussion with regard to servo failures is 
directly applicable to controller failures, and the same considerations with 
regards to fault tolerance and recovery must be made. 

Digital controllers with intermediate cross-straps. - Systems with 
intermediate cross-straps can tolerate more failures before a complete 
collapse than those without. Failures that can occur on one side of a cross- 
strap are dissimilar or noriidentical to those on the other side. The cross- 
strap serves to isolate or insulate one class of failures from another. The 
presence of an intermediate cross-strap does not in any way alter the redun- 
dancy requirements for a system to survive a certain number of identical 
failures and will not be discussed further in that respect. 

The use of intermediate cross-straps does, however, provide additional 
success paths and consequently, improved operational reliability. This 
improvement requires increased complexity, and accordingly, increased cost. 

It is necessary, therefore, in each specific application to make the tradeoffs 
of cost versus reliability before the optimum configuration can be determined. 
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For the purposes of this study, configurations without cross -strapping, v 
with analog crossfeed and with digital processor intercommunication were. - 
structured in order that the full spectrum be investigated. , .t 

Digital Flight Control Sizing 

One of the questions which cannot be answered in general is whether 
a general-purpose (GP) or a special-;purpose (SP) machine should be- used. 

The particular situation or application will dictate the most effective imple- 
mentation. For the purposes of the discussions in the following subsections, 
a general-purpose (GP) machine is considered to be one that is capable of 
performing all elements of a flight control system, such as control laws, 
logic, self-test, etc. , by incorporating the proper computer program (soft- 
ware). A special-purpose digital machine is one mechanized and dedicated 
to a specific function, such as a control transfer function. A digital differential 
analyzer is an example of this type of machine. 

A question that must be addressed in the early stages of configuration 
definition is the size of the machine. In GP approaches, this means memory 
size and the data throughput (i. e. , the quantity of data that is processed by 
the computer in a given unit of time). In SP machines it means the number 
of integrators that will be required and the basic computation rate. Memory 
size (the number of storage locations required) is approached from several 
viewpoints. The required storage locations are broken down, into ^arithmetic 
instructions (adds, subtracts, multiplies, and divides) constants, variables 
(dedicated scratchpad), housekeeping (miscellaneous) and temporary storage 
(reusable scratchpad). 

The breakdowns are accompanied by "equivalent execution” times. , 
These times were arrived at by expressing all execution times in ternas of an 
equivalent number of adds (timewise). These two tools enable one to deter- 
mine the power required by a GP machine to perform a particular task. For 
example, all one has to do is examine the digitizer control system and extract 
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from it, the various computations that will be required. The computations 
can^be translated into storage location count and equivalent execution times. 
The total storage location count yields the memory size. in. terms of digitaL 
words. The equivalent execution times divided into the available time reveals 
the maximum permissible add time. These two parameters in general will 
specify the power that a GP machine must possess. 


• " Transfer function sizing. - Virtually all transfer functions commonly 
encountered. in automatic flight control systems, are special cases of the ■ 
general second-order transfer function 


-GCS) = ^ 


+ bs + c 


ds . + es + f.. 


T^-s +251ujls+uul 
^2 2 
s + s ?2 iu2 s + u >2 


For example, a high pass 

G(S) = rrxr where a 
es+i 



0 and f = 1 


and a lag' . 

. I ' G{S) = where a = b = d = o and f = 1 ’ 

A study of the general transfer function, then, is in effect a study of 
all subsidiary transfer functions since they can be .obtained by forcing certain 
coefficients ‘to take on specified values, ■ . . 


A number of techniques have been developed over the years for con-- 
verting continuous transfer functions into discrete difference equations for 
solution on a GP machine. One of the more popular techniques is a bilinear 
transformation known as the Tustin method. Its popularity is due to several 
highly desirable properties: 
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• Cascade property 


• Stability invariance 

• D-C gain invariance 

• Ease of application and understanding 

Conversion methods that cascade have a property such that if the 
discrete-time transforms of G(S), Gj^(S), and GgCS) are G(Z), Gj^(Z), and 
G2(Z) respectively and if G(S) = Gj^(S)G2(S), then G(Z) = Gj^(Z)G2(Z). This 
ability to preserve this continuous -time relationship in the discrete-time 
domain is very desirable because it permits partitioning the digitized system 
into several simpler segments. The Tustin conversion method has the cas- 
cade property. ..... 

Stability invariance is a property such that, if a continuous-time 
function G(S) is stable (i. e. , all of its poles are in the left half plane), then 
all the poles of the discrete-time G(Z) will be within the unit circle. In 
other words, stable functions are transformed into stable functions. The 
Tustin method always preserves stability. 

D-C gain invariance simply means that the steady-state gain in the 
discrete time domain is equal to that in the continuous -time domain. The 
Tustin method also has this property. 
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If second- and higher-order terms are neglected, then 



1 - 


1 + 


ST 

2 

ST 

2 


Solving for S yields 


ij . .• 




.-1 


T l: + Z 


To use the method, one simply makes the substitution for the complex 
variable S in the transfer function. For example, the expression 


G(S) = 

ds^ + es + f 


becomes 




G(Z) = 


1 + Z 


, ...2 a - z '^ , .. 

-TY)2 + b^ { - —■)+ c 


1 + Z 


,2 ,1 - . 2 ,1 “ 

d -FtT ( ® T" ^ T 

1 + Z ■ ^ 1 + Z ^ 


) + f 


This simplifies to 


K, + K„ Z ^ + K„ Z ^ 

G(Z) = ^ 

■ 1 + K. Z.:^ + K. Z ^ 

4 5 


where 


_ 4a + 2bT + cT^ 
- 1 ■ A 

_ 2cT^ - 8a 
^2 A 
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4a - 2bT + cT^ 
‘3 ■ A 

. 2fT^ - 8d 
4 “ A 


K 


5 


1 4d - 2eT + fT^ 
A 


T is the sample period and Z ^ is the delay variable. 

Similar transformations can be made for other continuous -time 
transfer functions. 


The generalized expression can be programmed by recalling that a 
transfer function is the ratio of the output to the input: 




1+K. Z‘l +K. Z 
4 5 


Solving for y(z) 

y(Z) = Kj u(Z) + U(Z) Z~^ + Kg U (Z) z"^ - y(Z) Z~^ - y(Z) Z"^ 
or 

y(n) = Kj u(n) + u(n-l) + Kg u(n-2) - y(n-l) - yin-2) 

This expression can be now programmed directly on a digital computer. 
An assembly language program that implements this realization follows: 
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Mnemonic instruction 

Argument 

LDA 

“^5 

MPY 

y(n-2) 

STA 

TEMP 1 

LDA 

y(n-l) 

STA 

y(n-2) 

MPY 

'^4 

ADD 

TEMP 1 

STA 

TEMP 1 

LDA 

u(n-2) 

MPY 


ADD 

TEMP 1 

STA 

TEMP 1 

LDA 

u(n- 1) 

STA 

u(n-2) 

MPY 

^2 

ADD 

TEMP 1 

STA 

TEMP 1 

LDA 

u(n) 

STA 

u(n-l) 

MPY 

^1 

ADD 

TEMP 1 

STA 

y(n-l) 


In summary form this amounts to: 

• 5 multiplies 

• 4 adds 

• 1 temporary storage location 

• 4 delay variables 

• 5 constants 

• 13 housekeeping (miscellaneous) 



There are 22 instructions that must be executed in this program. 

Each of the 17 nonmultiply instructions require approximately the same time 
to execute which will be called, an add. time. Small airborne computers 
typically require approximately four times as long to perform a multipli- 
cation as. they do for an addition. This 'relationship can be used to express 
multiplies as equivalent adds, bringing the total execution time to 37 add 

■times. The program has a total- memory allocation requirepaent ^of 3,4 , : - 

instructions. ■ • 


It should be noted that the above. program requires four delay variables 
to realize a second-order equation. It seems reasonable to suppose that it 
could be realized with only two delay variables. This is, in fact, the'caise- 
and there are, perhaps, an unlimited number of two-delay realizations that 
could be formulated. ' 

The above techniques' are used similarly to size other typicaT transfer^ 
function computations. 

Six transfer functions; are commonly, encounted in flight control appli- 
cations. These transfer functions are listed in Table 2 along with the., 
memory and time requirements for general-purpose implementation and 
integrator requirements for special-purpose (DDA) machines. 

/ , Nine nonlinear functions are commonly, encountered in flight control 
systems. These are listed oh Table 3 along with'-'geheral-' •ahd“ special- ' ■' ’*'• 

‘ ■.'.‘-'ii. '-j . .... ■ • 

purpose machine requirements. 

The mode logic sizing calculations are performed be estimating the 
number of equivalent two-input AND and OR gates employed. The equivalent 
. add times and instruction count are determined from actual coding experience 
for a typical airborne computer and are listed in Table .4. . • 
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TABLE 2. - TRANSFER FUNCTIONS 

..f . 


r.-. 

Function 

General-purpose 

requirements 

Special-purpose 

integrator 

requirements 

Memory 

allocation 

(locations) 

Equivalent 
execution 
time in adds 

2nd order/ 2nd order 

30 

34 

7 

2nd-order lag 

30 

34 

6 

Lead -lag 

18 

20 

4 

Lag- lead 

18 

20 

5 

Lag - 

18 

19 

3 

High pass 

18 

19 

2 

Integrator 

16 

16 

1 


TABLE 3. - NONLINEAR FUNCTIONS 


■ Function 

General-purpose 

requirements 

Spe c ial- p urpo s e 
integrator 
requirements 

Memory 

allocation 

(locations) 

Equivalent 
execution 
time in adds 

Gain schedules 

22 

6 to 13 

1 + ext hdwe 

Synchronizer 

12 

5 to 7 

1 + ext hdwe 

Backlash 

57 

16 to 22 

' Difficult 

Limiter 

14 

5 or 6 

1 + ext hdwe 

Deadband 

10 

4 or 5 

1 t ext hdwe 

Bleed-off/ fade- in 

41 

29 or 31 

3 + ext hdwe 

Hysteresis switch 

37 

9 to 11 

1 


Trig and exp functions 
1 1 

8 or 35 

1 1 

7 to 52 

1 

1 or 2 
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TABLE 4. - AND/OR GATE REQUIREMENTS 



General-purpose 

requirements 

• j ' i 

Function 

Memory 

allocation 

Equivalent 
execution 
time in adds 

' • . 

Spec ial-purpose 
integrator 
requirements 

Two- input AND gate 

4 or 7 

4 or 7 

'• Ext hdwe 

Two- input OR gate 

4 or 7 ' 

4 or 7 

Ext hdwe 


The four-instruction and four-add-time case corresponds to the situ- 
ation where the gate output is not saved in scratchpad but remains in the 
accumulator awaiting the next instruction. The second case is when the gate 
output is saved for use later in the software. 

Sampling rates. - An integral part of computer sizing is selection of 
the sampling rates. A number of "rules of thumb" exist which translate a , 
control frequency into a sampling rate. These rules yield factors of 5 to 20 
times the control frequency for the sampling rate. The rule employed here 
is derived from a consideration of the phase lag introduced by a zero-order 
hold circuit. , 

While a great deal of attention is given to the phase characteristics 
associated with a particular digital mechanization of a transfer function, 
often little attention is give^n to the zero-order hold pha.se. The p^hase 
characteristics of a zero-order hold are described by ^ 

0 = |- 180° 
s 

where f is the sampling frequency. The maximum phase shift in bending- 
s 

mode control loops that can be readily compensated for through the addition 
of lead is 5 deg. Based on this 



which is the "rule of thumb" that will be used for the ATT sampling rate 
selection. 
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From reference 1, the flutter frequency of the ATT is approximately 
4 Hz which yields a sampling rate of 144 Hz. With 160 Hz selected as the 
highest sampling rate requirement, the following rate tree structure was 
< employed: 

Function 

Gust/maneuver load and flutter control 
Stability augmentation 
Outer-loop control 
Mode control 

Word length. - Word-length requirements for constant data can be” 
obtained from the transient response requirements of the digital filter. A 
means for determining suitable transient response for the digital' represen- 
tation of the filter is by an examination of the difference equation roots. A 

- Pt 

first-order lag of the form P/(S+P) has a transient solution Y(t) = Ke 
Let t - nAt khd rewrite Y(t) as 

Y(t) = K 

The corresponding Tustin equation 

Y(n) = a Y (n-1) + b[X(n) + X(n-D] 

. . ' ' * - 

has a transient solution, Y(n) = KX^, where X is the difference equation root. 
Hence, ideally X = 

However, acceptable performance results if Xg ^ X ^ Xj^ 

where: 

and 

, _^r(P + AP)At 



Rate (Hz) 
160 

80, 40 
40, 20 
10 
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In order to adjust the root with acceptable accuracy, the constant must be 
adjustable in steps of where: 

l AXj = Xj^^ “ X 2 = 2e sinh APAt. 

The size of the minimum step adjustment is the value of the least significant 
bit of the binary constant word, i. e. 

I AX 1 = 2 “^ 

Thus . , 

2”^ = sinh APAt . 

N = “log 2 C2e sinh APAt) 

To obtain practical meaning from these equations, consider, the 
following example: ,, 

P = 0. 2 rad/sec 
AP = . 01 (57o) 

At = 0. 00625 (160 iterations /sec) 

then 

N > -16g2 (2e“°' sinh (. 0000625)) 

N>13. 96 
N = 14 bits 

Hence, for a 5-secbhd lag with a b-'p.erceht accuracy requirement on the 
pole placement, the digital filter equivalent utilizing a sampling rate of 160 
per second requires an accuracy of 14 bits for the constant. 
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The requirements on setting the zeros within a prescribed accuracy 
are identical to those on setting poles. However, the response error intro-^ 
duced by a misplaced zero is not easily specified since the zeros do not 
directly alter the time response but rather indirectly alter it through the 
residues. However, the following general statements apply: 

• If a pole and zero are located in proximity, the response error 
introduced by mislocating the zero is as great as that of mislocating 
the pole. 

• If the frequencies of interest are in the frequency band dominated by 
the zero (e. g. , pseudo differentiation), the error in response intro- 
duced by a misplaced zero is the same as for a misplaced pole. 

The constant-data word length requirements are related to the 
transient response requirements whereas the scratchpad and accumulator 
word length requirements are related to the particular or driven solution. 

For the sake of simplicity, consider a first-order filter described by the 
difference equation Y(n) = a Y(n-l) + b[X(n) + X(n-l)], which was the result of 
applying Tustin's substitution method to a first-order lag. The coefficient 
b is then given by b = T/(2 t + T), where T is the sample period and t is the 
filter time constant. 

For the filter output Y(n) to change, the input X(n) will have to change 
an amount b[X(n) + X(n-l)] ^ least-significant bit weight of Y(n). Suppose 
T = 5 sec and T = . 00625 and Y(n) is scaled 8 (the binary point has been moved 
8 places to the right): 



Sign 

bit 


Binary point 


LSB 
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-N 

Further, the LSB weight = 2 units. K the input is a step, the 
magnitude must be 

2b X(n) ^ 2‘^ where b = 0. 2/(160 + 0. 2) = . 001258 
for a change to take place in the LSB. In terms of the LSB 

N = -log2 [(% deadband) (2b) (2. 56)] + 8 

For 1-percent deadband, the number of magnitude bits is N ^ 22. 

Based on the 160-Hz sampling rate, a 16-bit constant memory and a 
16-bit (32-bit via double precision in the high- iteration loops) scratchpad 
memory, an accumulator was judged to be adequate and cost effective. 

Double precision is required in only seven first-order filters in the high- 
rate loop. ' This imposes an additional memory requirement of 15 SPAD 
words (14 filter variables and 1 temporary variable). Additional instruction 
memory is not required as the double-precision ADD /SUB /LOAD /STORE 
instructions are used instead of single -precis ion ADD/SUB/, etc. , instructions. 
This results in a memory increase due to double precision of 240 bits of 
SPAD. On the other hand, if a 32-bit processor (data words only) is needed, 
each datum word must be increased by 16 bits. Since 223 SPAD words and 
556 constant words are required, an increase of 3570 SPAD bits and 8900 
constant bits results. Thus, the 32-bit processor requires 3330 SPAD and 
8900 constant bits more than the 16-bit double-precision processor. 

Assuming semiconductor memory costs of $. 082/SPAD bit and $. 011/constant 
bit (half the current price in large quantity), the 16 -bit double precision 
approach price is $2310 less for a four-processor (quad-channel) system, 
based on memory costs only. 

Processor costs will be less for the 16-bit double-precision approach 
also, particularly if microprogramming is used. For the ATT flight control 
application, the 16-bit double-precision approach provides significant cost 
advantages for a fleet of 200 aircraft. 
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ATT processor sizing. - The time sizing calculations are broken into 
the functions of 

• Analytical computations 

• Input/ output 

• Mode logic 

for landing/go around, enroute (outer loops), and the flight -critical system 
(inner loops). 

The time sizing for these systems is tabulated by function in Tables 
5, 6 and 7. Redundancy management, on- line /off- line BITE, executive 
structure and initialization are treated as separate entities. 

Redundancy computations in units of add times per sensor input 
break down as follows: 


Dual comparison 4 

Triple select 86 

Quad select 172 


Two configurations are sized for a quad system: (1) a two-processor 
configuration with an lOP (input-output processor) and a CCP (control compu- 
tation processor), and (2) a single-processor-per-channel configuration. 

Using the time information for the enroute and critical systems 
(Tables 6 and 7), the time sizing is summarized for the lOP and the CCP in 
Tables 8 and 9. The simultaneous operation of these two modes will result 
in the maximum computer load. The single-processor time sizing is given 
in Table 10. 
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TABLE 5. - LANDING /GO- AROUND TIME SIZING 


Analytical computations 

Pitch 

Roll 

Go -around 
Totals 

Mult /sec \ 

',7 AddsYsec ’• 

'■ „82d 

820' 

520 

2 160 

■ Y ■ ■■5T40'"' 

5 220 
3 500 . 

; 14 060 ‘ 

Input /output (single) ; 

Pitch 

Roll 

Go- around 
Totals 

Mult /sec ' 

■■■' ■ Adds'/sec’ 

00 00 
O OOP 

1 

'• 120 

...J 280 

; 1:60'. 

i 56 P'^ 

1 Mode logic 1 

Pitch 

RoU 

Totals 

Two- input gates ^ 

Adds /sec ' 

■ ' 3 5': 

• • • -■ 

70 

'■ ! ‘ 1 520 • 

■J 1 520 

1 3 o4;o' Y 

Grand 

. total's ... 

Mult /sec 

Adds /sec 

2 440 

' .17 660 


Ten percent are seven- add time gates 





TABLE 6. - ENROUTE SYSTEM TIME SIZING 
(OUTER LOOPS) 


Analytical computations 

( ' 

Mult /sec. 

Adds /sec 

Pitch 

1 300 

11 060 

Ron 

940 

7 180 

Yaw 

-- 


•Totals 

2 240 

18 240 

Input /output (single) 


Mult /sec 

Adds /sec 

Pitch 

240 

480 ' 

Ron 

140 

280 

Yaw 

-- 

-- 

Totals 

380 

760 

Mode logic 


Two- input gates 

Adds /sec 

Pitch 

40 

1 720 

Ron 

40 

1 720 

Y aw 

25 

1 075 

Totals 

105 

4 515 

Grand 

Mult /sec 

Adds/sec 

totals 

2 620 

23 515 




TABLE 7. - CRITICAL SYSTEM TIME SIZING 
(INNER LOOPS) 


Analytical computations 


Mult /sec 

Adds /sec 

Pitch CAS 

520 

3 960 

Roll CAS 

680 

8 040 

Yaw CAS 

2 200 

10 120 

Flutter control 

2 720 

15 200 

Gu St /maneuver ' 


— 

load control 

3 520 

22 080 

Mach trims 

110 

480 

Totals 

8 950 

59 880 

Input (single) 


Mult /sec 

Adds /sec 

Pitch CAS . 

240 

480 

Roll CAS 

240 

480 

Yaw CAS 

400 

800 

Flutter control 

160 

320 

Gu St / maneuver 



load control 

960 

1 920 

Mach trim 

10 

20 

Totals 

2 010 

4 020 


Mode logic 



Two-input gates 

Adds /sec 

Pitch 

40 

1 720 

RoU 

40 

1 720 

Yaw 

12 

560 

Totals 

92 

4 000 

Grand total. 

Mult /sec 

Adds /sec 

single input 

10 960 

67 900 




TABLE 8. - lOP TIME SIZING 


Function 

Mult,/sec 

Adds /sec 

Servo output command 
selection 


89 000 

Servo monitoring 


20 300 

Input /output 


30 000 

Hexad— ♦body rate plus 
sensor monitoring 

2 160 

12 000 

Bus control 


9 600 

Executive 


2 000 

Self test (continuous) 


5 000 

Totals 

2 160 

167 900 

7 


TABLE 9. - CCP TIME SIZING 


Function 

Mult /sec 

Adds/sec 

Analytical computations 

11 190 

78 120 

Mode logic 


8 515 

Executive 


4 200 

BITE 


3 000 

Signal select 



Rate sensors (6 /chan) 


49 333 

Accel sensors (6 /chan) 


39 900 

Control pos (6 /chan) 


30 466 

Air data (6 /chan) 


16 317 

Surface pos (13 /chan) 


63 482 

Attitude (3 / chan) 


14 502 

Totals 

11 190 

307 835 

1 



















TABLE 10. - SINGLE-PROCESSOR TIME SIZING 


Function 

Mult /sec 

Adds/sec 

Analytical computations 

11 190 

78 120 

Input /output 

3 850 

14 600 

Signal select 


214 000 

Hexad-to.-body-axis 

conversion 


20 400 

Intercom crossfeed 


8 000 

Mode logic 


8 500 

Servo monitoring 


20 300 

BITE 


5 000 

Executive 


7-200 

Totals 

15 040 

376 126 


In the two-computer configuration, all I/O operations are performed 
by the lOP and the CCP need only to access its scratchpad memory for sensor 
inputs. Additionally, the lOP performs all the servo monitoring. 

From Tables 8 and 9, with a four- to- one ratio of multiply to add 
time, the lOP throughput is 177 KOPs per second, and the CCP throughput is 
353 KOPs per second. The addition of the single -processor time sizing in • 

Table 10 yields a grand-total throughput requirement for the CCP of 435 KOPs 
per second. 

Memory sizing. - The memory size for each function is given in 
Tables 11, 12 and 13 in terms of instruction, constant and scratchpad 
memory words. As with the time estimate, the memory estimate, for the 
most part, is based on actual coding experience with an airborne computer. 

The BITE, executive, and initialization functions are estimated as a percentage 
interpolated from existing flight control software. - 
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TABLE 11. - LANDING /GO- A ROUND MEMORY SIZING 



TABLE 12. -■ ENROUTE SYSTEM MEMORY SIZING 


Function 

Instruction 

Constant 

Scratchpad 

Anailytical computations 

• 



Pitch 

588 

99 

40 

Roll 

429 

78 

28 

Gu St /maneuver 
load control 

177 

34 

8 

Totals 

1 194 

211 

76 

Mode logic 

46 2 

-- 

5 

Input /output (single) 




Pitch 

36 

12 

12 

Roll 

21 

7. 

7 

Gust /maneuver 
load control 

15 

5 

5 

Totals 

~2 

24 

24 


65 









































TABLE 13. - CRITICAL SYSTEM MEMORY SIZING 


Function 

Instruction 

Constant 

Scratchpad 

Analytical computations 




Pitch CAS 

108 

16 

9 

Roll CAS 

222 

31 

10 

Yaw CAS 

307 

48 

25 

Flutter control 

119 

19 

13 

Mach trim 

66 

16 

6 



■ IIMI» 


Totals 

822 

130 

63 

Mode logic 

462 

16 

5 

Input /output (single) 




Pitch 

18 

6 

6 

Roll 

18 

6 

6 

Yaw 

30 


10 

Flutter control 

6 

2 

2 

Mach trim 

3 

1 

1 


1 1 1 

■■ 

■ 1 

Totals 

75 

25 

25 


Redundancy computations require the following memory sizing: 



Inst. 

Const 

SP 

Dual comparison 

60 

8 

-- 

Triple select 

600 

60 

-- 

Quad select 

1200 

120 

-- 
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For the two-computer configuration, the memory requirements for 
the lOP are: 



Function 


Memory words 


Servo output command select 

450 

Servo monitoring 

500 

Input/ output 

315 

Hexad p- body rate 

plus sensor monitoring . 

750 

Bus control 

250 

Executive 

285 

Self test 

750 

Total 

3300 


For the CCP, the requirements are: 


Function 

Memory words 

Analytical computations 

3566 

Mode logic 

1070 

BITE 

1500 

Initialization 

753 

Executive 

491 

Signal seleot 

1320 

Total 

8700 
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For the single-processor triple- select configuration, the requirements 


are:- 


Function 

Analytical computations 
Input'/ output 
Mode logic . 

BITE 

Initialization 

Executive 

Signal select 
Total 


Memory words 
3566 
315 

. 1070 - 

2000 

753 

1776 

660 . 
10 140 


For a quad-select configuration, the total memory requirements are: 


Function 


Memory words 


Analytical computations 
Input/ output 
Mode logic 
BITE 

Initialization 

Executive 


3566 

315 

1570 

2000 ; 

' ' 5 ■ ■ 

753 

2500 (includes computer 
• intercommunication 
software) 


' Quad signal select . • 1320 T 

Total 12 024 

Based on the block diagrams* of Section 4 and the selected sample 
ra.tes, the computer requirements for an ATT quad-select system are 411 
KOPs per second with 12, 024 words of memory. 

J 


Processor sizing is summarized in Table 14. 


88 



Maximum ti 


Function 

lOP 

CC 

Mult / sec 

Add/sec 

Mult /sec 

Servo output 

command 

selection 


89 000 


Servo monitoring 


20 300 


I/O 


30 000 


Hexad-to-body 

rate 

2 160 

12 000 


Bus control 


9 600 


Executive 


2 000 


Self test 


5 000 


Analytical comps 



11 190 

Mode logic 




Signal select 




Intercom cross- 
feed 




Initialization 




Total 

2 160 

1 

167 900 

11 190 






































































SECTION 6 

COMPONENT TECHNOLOGY TRADEOFFS 


In compliance with the NASA-Langley Statement of Work, a technology 
survey was conducted during the initial stages of the study. The survey 
consisted of a literatxire search and discussions with experts and specialists 
in the various implementation areas. The resvilt of the s\irvey was a tech- 
nology forecast — essentially a series of decisions regarding the optim 2 d 
mechanization technology applicable to the ATT FCS for the developmental . 
period of 1978-1980. The technology siirvey became continuous, extending 
throughout the study as the prelimineu:*y component trade studies were made. 
This report section describes both the technology survey and the component 
trade studies as they were performed during the program. The interdepen- 
dency of the two program tasks became obvious during the coimse of the 
study; the technology forecast provided data for the component tradeoffs, 
and the tradeoffs asked new questions to be answered by the continuing tech- 
nology survey. 

The component areas reviewed in this section include actuators, air 
data sensors, displays, electronics, inertial sensors and processors. Table 
15 summarizes the components and concepts 'which were included. ’ 


ACTUATION STUDY 

t 

The following paragraphs describe the actuation technology survey and 
component tradeoffs performed in the study. These include a brief history of 
actuation methods for aircraft control surfaces, considerations in the use of 
various types of actuator implementations and contemporary techniques for 
the redimdancy management, of fault-tolerant actuator configurations. 
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TABLE 15. - TECHNOLOGY SURVEY AREAS 


Actuation 

Processors 

Electronics 

Hydraulic 
Electromechanical 
Digital versus analog loops 
Tandem - parallel 
Summation - force /position 
Active / active- on- line / standby 
Servoed pump 

Integrated versus driver actuator 
Compared versus self-monitored 

General- purpose processors 
Small 
Medium 
Large 

Memories 

Semiconductor ROM, 
PROM, RMM. 

Large-scale integ ckts 
C/MOS . 

P/MOS 

Ultrasonic inverter 

Hi-v power transistor 
Monolithic darlington 
Stitch wired cards 

Displays 

Inertial sensors 

Air data sensors 

Conventional CRT 

Flat CRT 

LED 

Plasma panel 
Luminescent panel 
Liquid crystals 
PLZT 

HIGS/MIGS 
Laser sensor 
Vibrating wire sensor 
MHD sensor 
Electro static gyro 
Pendulous accelerometer 

Conventional capacitive 
Strain gage 
Vibrating wire 
Vibrating diaphragm 

Digital versus analog 
Processing 




.. Flight Control Actuator Evolution 

Control of the aerodynamic control surfaces on early aircraft 
required relatively little power. Prior to World War II, the only powered 
sairfaces were the low -authority, low- speed actuation systems required for 
automatic flight controls. The need for power-assisted and fully-powered 
aerodynamic control sxirfaces came with the development of the jet airplane. 

As speeds increased, control- surface hinge moments increased, and 
as vehicle size increased, control- simface areas also increased. The com- 
bination made powered surfaces necessary. Military aircraft were the first 
to feel the need for such devices, and, as vehicle speed range increased, 
actuator development kept pace. . . 

Aircraft with wide aerodynamic range require actuation systems of 
flexible performance; at low speeds, the control surfaces must be capable of 
large deflections with relatively high angular velocities, while at high speeds, 
correspondingly small deflections and high positional stiffness is required. 

It is this positional stiffness that makes the hydraialic servoactuator suitable 
for the task. 

This is not to say that other actuation methods have not been attempted; 
mechanical actuation systems which used clutches driven by engine power 
teikeoff shafts have been evaluated, and electromechanical servosystems have 
also been analyzed. The former system is difficult to mechanize in redundant 
form, and redimdancy is necessary for reliability. Large electromechanical 
systems, on-the other hand, are severly penalized by weight, heat, "and lack 
of stiffness. The result has been a concentration of effort on the basic 
hydraulic configiuration --a simple hydraulic cylinder, directly coupled to 
the aerodynsimic control surface. 

Hydratilic actuator development . - As control sxirface power require- 
ments went from moderate to large, hydraulic actuators developed from 
small boost-type actuators to large, irreversible devices. The boost-type 
actuators had force feedback systems -which allowed the pilot to retain "feel" 
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of the aerodynamic forces on the control surfaces; this was found to be unde- 
sirable for high-speed aircraft due to the high forces involved. An answer 
was found- in the artificial feel system, and irreversible control surface 
actuators become commonplace. ' 

I Further increases in power requirements made the power, actuator 
critical for larger portions of the flight regime, and reliability became a 
major requirement. In addition to significant advances in the design of cylin- 
ders, seals, servovalves and other essential actuator elements, improvements 
immaterials used in their fabrication allowed actuators to be designed for 
these larger loads, while weighing less than their earlier, less powerful 
predecessors. .1 To further ;advance the flight reliability of the critical flight 
control actuator components, the concept of redundancy was introduced. 

i ' Redundant hydraulic actuator designs . - The addition of multiple 
pumps provided. the- hydraulic power system with more reliability than the 
-previouSiSingle systems, but the full impact of the redundancy concept was 
not seen until entire hydraulic systems, including the actuator, were made 
redundant. • ' , , 

Increases in reliability requirements were simply met by the multi- 
cylinder hydraulic actuator. Two successful configurations evolved: the 
tandem cylinder and the multiple single cylinders arranged side-by-side along 
the control surface hinge line. The tandem configuration has been built in 
■ dual and triple designs,., with the dual being the most popular. Side-by-side 
configurations have been built with as many as twelve cylinders in integral 
hinge designs, as: well as. combinations of tandem and side-by-side applications 
to achieve "dual-dual" designs. . ■ . . 

Further flexibility in overall actuation system concepts is afforded by 
the use of "split surfaces" -- combinations of parallel, independent surfaces 
operated by individual -(or multicylinder) actuators, hi short, the variations 
of actuator.i!Gpnfigurations and control surface arrangements are virtually 
limitless.. . . , . . . 
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Driver or secondary actuator development . - The driver, or secondary 
actuator, is a device which accepts electric control signals and converts them 
into force, velocity or position of a mechanical output. The common forms 
are electromechanical, electropneumatic, or electrohydraulic in operation. 

The driver is designed to drive the input to the primary actuator which in 
turn positions the control surface. 

Two developments in the field of automatic control initiated the creation 
of electromechanical and electrohydraulic driver actuators for aircraft. The 
first was the all-electric autopilot which used a simple electromechanical-' ^ 
actuator operating in parallel with the pilot' s controls to position the aero- 
dynamic svirfaces of the controlled vehicle. As vehicle performance improved, 
the electrohydraulic actuator was developed to keep pace. ' ■ 

Further increases in aircraft dynamic range made the addition of the 
second control system necessary; vehicle performance was being extended 
into the aerodynamic ally unstable spectrum, so the stability augmentation 
system (SAS), with its high-performance actuators, was developed. The out- 
put of these actuators was combined differentially or in series with the pilot' s 
commands to position the primary surfaces as '^power steering" actuation. - • 

Aircraft performance continued to increase; the importance of high- 
authority SAS and control augmentation systems (CAS), the extension of auto- 
pilot functions, and the addition of automatic control for aircraft-mounted 
armaments showed that the majority of commands into the control surface 
actuators came from the automatic control channels. It was inevitable that 
the more simple, higher -performance FEW system should result. 

The performance potentials of FEW initiated construction of several 
demonstration vehicles. These were, for the most part, existing vehicles 
with mechanical manual systems "adapted" to FEW by the addition of electro- 
hydraulic or electromechanical driver actuators. These actuators were 
modified redundant CAS actuators with extended output capabilities and added 
channels so the desired level of redundancy could be achieved. 
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With continued development, the use of the driver actuator persisted 
because it enabled the monitoring logic requirements of the driver to be 
separated from the power -handling capabilities of the primary surface actua- 
tor. The mechanical connection became a cross-feed; control channel 
isolation had no effect on control surface power requirements, and the 
redxmdancy level of the surface actuator could be matched to its reliability 
^potential, independent of the number of control channels, 
r u . : 

?- "integrated" actuator development. - One of the most significant 
advantage of FBW is the elimination of primary control linkages, rods and 
cables. In some secondary/ primary actuator configiarations, this reduction 
is only partial because of the secondary-to- primary linkages. For this 
reason, recent efforts have been directed to the development of integrated 
actuators. 

Integrated actuators are primary control surface actuators which are 
capable of positioning the control surface directly from an electrical command. 
In some instances, the integrated actuator may contain some form of driver 
actuator, while others may be a straightforward electrohydraulic servoactua- 
tor with integral monitoring elements. In still another form, the integrated 
actuator may contain its own electrically-powered hydraulic supply; some of 
these use the controlled-displacement servopump principle. 


Implementation Considerations 

In considering the approach to mechanizing a FBW actuation system, 
it might be well to start with the actuation requirement. The FBW actuation 
system has two major tasks: one is to convert the electric command signal 
into a hydraulic signal; the second is to amplify that signal into a powerful 
output which can operate on the intended load. The first task is primarily 
concerned with the quality of the redundancy control signals, while the second 
is the ability, to handle the load of the aerodynamic surfaces over the entire 
flight range. 
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Actuation power selection . - The type of actuator selected for use as 
a control surface actuator depends on the characteristics of that load. A wide 
variety of actuation types have been used for various aircraft control applica- 
tions, but there have been a wide variety of load conditions in the many type 
of aircraft developed over the years. For the aircraft type under study, the / 

i 

general requirements for the actuators are fairly well known. ! 

Aside from the usual specifics of maximvim hinge moment, and velocity, 
the requirements unique to actuation systems for large, high-speed FBW 
aircraft are related to static and dynamic stiffness, frequency response, 
availability in redundant configurations, weight, size, and relative power 
consumption. 

The aerodynamic and structural characteristics of the control surface 
define the working and limit loads; the relationship between the control surface 
inertia, aerodynamic hinge moment, surface "flutter" characteristics, and 
the elasticity of the entire structure, including the actuator compliance, 
define the system dynamics. In hydraulic actuators, the bulk modulus of 
the working fluid, in addition to structural compliance, defines actuator 
stiffness. 

In a hydraulic actuator, the effect of this compliance in relation to 
control surface inertia is shown in Figure 19. It is the objective of most 
actuator installations to keep the natural frequency of this spring-mass 
system above the aerodynamic flutter frequency, and to do so means keeping 
the fluid spring as stiff as possible for a given surface inertia. 

Low bulk modulus, or lack of stiffness is a primary fault of pneumatic 
actuators. It is possible to use a rotary pneumatic motor and some type of 
gearbox to improve the situation, but such assemblies add a great deal of 
complexity to redundant systems. 

This same difficulty in making the mechanical output of a rotary device 
redundant is an obstacle to the development of electrical actuators -- which 
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CONTROL SURFACE INERTIA 



TYPICAL ACTUATOR ARRANGEMENT PHYSICAL EQUIVALENT 


Figure 19. - Hydraulic Actuator Spring-Mass Analogy 


CD 

-a 







also are encumbered by high control-power requirements, excessive heat 
dissipation and relatively high weight. The corresponding advantages of the 
hydraulic actuators are: its ease of configuring into redundant systems, its 
high force gain and stiffness, and its relatively light weight. These have made 
it the accepted standard actuator for flight control applications. 

In driver actuator applications, the comparison is somewhat different: 
the input load to a primary surface actuator valve is relatively low, especially 
for the sizes needed for subsonic aircraft. As a result, the power require- 
ments for a driver actuator are not nearly as severe; the driver only need 
provide sufficient force to overcome friction, power valve flow forces, and 
emergency "jam-breaking" forces. As a result, both hydraxalic and electric 
(ac, dc, and stepper motors) are candidate approaches. The advantages of 
the electric devices lie in their independence of hydraulic power di^ribution 
and simplicity of maintenance. 

Driver actuator versus integrated actuator . - One of the theoretical 
advantages of the FEW system is the potential of eliminating all manual 
mechanical linkages. However, all of the FEW aircraft to date have been 
vehicles modified for FEW evaluation and, as such, have used driver actuators 
as an effective method of connecting into the existing manual linkages. In a 
vehicle designed specifically for FEW, all of the surface actuator input 
linkages can be eliminated; an example of how this can be done is shown in 
Figure 20. 

Two methods of coupling the driver actuator into the surface actuator 
are shown --a position- summed system and a velocity- summed arrangement. 
In the position- summed configuration, a driver actuator with a relatively long 
stroke positions the input linkage to a control surface actuator; positional 
errors move the power servovalve to direct flow into the main cylinder so that 
zero difference exists between the driver actuator output and the surface 
actuator output. Note that only one feedback LVDT is required per channel 
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ACTUATION CYLINDER 
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Figure 20. - Driver /Surface Actuators - Generalizeid Configurations 
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In the velocity- summed configuration, the driver acutator moves the 
spool of the power servovalve directly; its flow powers the main surface 
actuator, and electrical feedback from the main acutator closes the servo 
loop. Velocity feedback, in the form of power servovalve spool position, 
is required to stabilize the loop. Note that the driver actuator only need be 
a short- stroke device; actually, it could drive the valve spool directly, 
instead of through a linkage as shown, thereby eliminating' all linkages in 
the actuator package. 

The configurations shown in Figure 20 and variations thereof may 
appear to be integrated actuators, but they are really only driver acutator/ 
surface actuator "packages" wherein both the conventional driver and 
sxirface actuator have been combined into a single assembly. Where it is 
desirable to use a surface-actuator configuration other than the tandem unit 
shown, the input linkage arrangement may become quite complex, as 
shown in Figure 21. For example, if three individual surface actuators, 
distributed along the control surface hinge line are desired, and if a 
conventional driver actuator is selected to operate them, a number of 
actuation systems are possible. As shown in Figure 21 (a) each of the 
three surface actuators may be imits with integral power servovalves and 
feedback linkages. The output from the driver can then be linked to each of 
the surface actuators. Or each surface actuator may contain one channel 
of the driver, as shown in Figure 21 (b), and a driver linkage used to 
synchronize the inputs to the power actuators. Or, as shown in Figure 21 (c), 
the power servovalves may be packaged with the driver actuator and the 
surface actuator cylinders hydraulically coupled thereto. Electrical feed- 
back from the surface for each driver channel would then be used in a 
velocity- summed servosystem. 

All of these arrangements require some type of input linkages; in the 
latter case, the amount used is very small and easily protected, so that 
configuration would have a very'high reliability rating. The other 
arrangements are susceptible to the usual problems of control linkage. In 
the second case, the synchronizing shaft could carry substantial loads and 
be affected by backlash at the pivot points. 

1,00 
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TRANSDUCERS 


(a) 


(b) 


(c) 


Figure 21. - Driver Actuator, - Surface Actuator System Mechanizations 







A completely integrated actuator can minimize the problems 
associated with input linkage systems. One basic form of such an actuator 
is shown in Figure 22. On this surface actuator, the electrohydraulic 
servovalve controls the flow to the surface actuator --no input linkages are 
required, no power servovalve is needed. Miscellaneous components, neces- 
sary for monitoring, synchronizing, and bypassing are necessary, but 
these are easily integrated into the simple, straightforward design. Note 
that there are no exposed linkages or other elements susceptible to jamming 
or inadvertent breakage. Because of the simplicity of such actuators, 
considerable effort is being devoted to their potential use in flight control 
systems. 

Distributed hydraulics and servopump actuators . - Hydraulic actuators, 
when used in flight control applications, are supplied with fluid from separate, 
special hydraulic power systems. Because of the importance of the surface 
actuators in the control of the vehicle, every effort is made to provide them 
with well-filtered fluid at well-regulated pressures from a system of 
maximum reliability. The fluids are selected for best overall performance 
under all conditions, and every effort is made to maintain the integrity of 
the distribution system. 

The fluid used in hydraulic servoactuators must have a number of 
important characteristics. Besides having the proper viscosity and 
viscosity index for operating over a wide range of temperatures, it must 
provide adequate lubricity over those ranges for maximum component life. 

The bulk modulus, or compressibility, must be such that its effect in the 
spring-mass system of the aerodynamic control surface is not detrimental. 

It should have a relatively high specific heat so that the temperature build- 
up from pressure drops in servovalves and other throttling devices is 
minimal. In transport aircraft, it is also important that the hydraulic 
fluid be fireproof; unfortunately, most fireproof fluids in use today subject 
the valves (and other components where fluid velocity is high) to high rates 
of erosion. This effect is so severe that servoactuator maintenance 
schedules are determined by the performance degradation caused by erosion 
rather than by seal wear or other intuitively-based reasons. 
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Figure 22. - Single-Channel Integrated Actuator for Constant-Pressure Supply 



The operating pressure of. the distributed hydraulic system is usually 
determined by the ^'weight efficiency" of the specific system. .While the . 
weight of the distribution system, pumps, filters, and other elements can be 
minimized by the use of high pressures, .the small cylinder areas associated 
with these systems can create stiffness problems resulting from low-bulk- 
modulus fluids. It is important to realize that the relationship between 
control surface configuration, surface actuation system arrangement, 
hydraulic power system characteristics, and control system dynamics are 
very critical. The hydraulic actuator is capable of handling very large , . 
aerodynamic loads accurately, but control surface inertia.is difficult to 
handle in large amounts. 5’or this reason, the. air frame control surface 
designer may actually increase actuator power requirements by reducing 
the aerodynamic load, if that reduction w.as accompanied by an increase in 
inertia. , . 


The characteristics of the aerodynamic control surface define the 
power requirements of its hydraulic actuator -- the aerodynamic hinge 
moment required for control deflections needed at maximum dynamic 
pressure determine actuator force. The control- surface rate needed for 
low- speed maneuvers, such as landing approaches, determines the. 
maximum actuator speed. The product. is hydraulic power. Unfortunately, 
maximum rate is not usually needed-when maximum force is, and vice versa. 
During a landing approach, when control surface hinge moments are minimal, 
the actuators must consume the maximum amount of hydraulic power, and, 
because those loads are. minimal, all the pressure from the system is converted 
into heat at the servovalve., Unless the fluid is cooled, the excess heat can 
destroy various elements in the system and result in failures. . 

Hydraulic heat is also generated when erosion of the power 
servovalves becomes excessive -- when the valve lands are so eroded that 
a continuous "leak" takes place at higH pressures. While the fluid is not 
lost from the closed system, it is heated due to the energy converted from 
the pressure drop.. To prevent this heating, as well as minimize the re- 
duction in performance due to the erosion-generated valve hysteresis, 
provision must be made to periodically test each actuator for excessive erosion. 
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The distributed hydraulic system, with its engine-driven pumps 
supplying fluid at constant presstme, is a design problem; the actuator heeds 
the fluid at full pressure to overcome the aerodynamic hinge monent at 
m^imum ”q", but, when maximum actuator velocity is needed, the loads 
are so low that most of the generated hydraulic power is converted into heat. 
One possible solution to this problem is the servopump actuator, a 
schematic of which is shown in Figxire 23. In this configuration, a control- • 
surface actuator is supplied with fluid directly from a variable-displacement 
servopump. The displacement of the pump shown is a function of the angle 
of the swash plate; when it is vertical (perpendicular to the drive shaft 
axis), the pistons in the rotating cylinder barrel have no reciprocating motion, 
and no fluid flow takes place. If the stroking servocylinder should move the 
swash plate in one direction or the other, fluid will be pumped from one 
side of the actuator cylinder to the other, and the output piston will move 
the control surface. An electric motor is used to drive both the servopump 
and a constant-pressure primary pump which provides fluid for the electro- 
hydraulic servovalve- controlled stroking cylinder and the replenishing- 
valves, which keep the actuation cylinder filled. 

The- integrated actuator shown also has a pressure transducer for 
monitoring and synchronizing purposes, and an automatic bypass valve to 
disengage the cylinder upon failure. Other servoactuator elements, feedback 
transducers, etc., are also' shown. 

The servopump is a iinique solution to the actuator problem because' 
it has no valves or flow-throttling devices in the power circuit; when the load 
on the actuator is high, pump pressure is high. Conversely, when the load 
is low, pump pressure is low, and, used in conjunction with carefully-de- 
signed control surfaces, the peak power input will be relatively low. Again, 
because there is no power servovalve, erosion is minimized. 

A servopump, in addition, can always be matched to the load -- the 
maximiim operating pressure can be selected to match the piston area as 
defined by resonsint bulk modulus effects, and the pump flows can then be 
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Figure 23. - Single-Channel Integrated Actuator with Electrically Driven Servopump 




adjusted accordingly. Each stirface actuator on a given aircraft could 
conceivably be operating over a different pressure range. 

Maintainability is very good because there are no hydraulic fittings 
or lines to disconnect: removal of an actuator requires only separation of 
the mechanical and electrical disconnects. Unfortiinately, weight of the 
electrically powered package is high* and some difficulty has been experienced 
in obtaining satisfactory frequency response, but current development is 
expected to solve these problems. 

Analog versus digital servo loops. - The objective of this design 
tradeoff was to evaluate the feasibility and/or utility of a digital servo loop. 
The primary reason for considering a digital loop was a possible cost/ 
complexity reduction through multiplexed signal transmission. The 
evaluation addressed not only the all-digital servo loop, but a range of 
alternatives between digital and analog as defined below: 

! 

• All-digital (computation* servo, and digital servo feedback sensors) 

• Digital servo loops except for feedback sensors 

• Analog servos and electronic computation with digital multiplexed 
monitoring and equalization 

• Analog servo loop with dedicated monitoring logic 

It is concluded that an "all-digital'’ servo loop is not state-of-the-art for 
ATT actuators due to lack of adequate electronic/electrohydraulic servo 
loop elements. Additional development of digital valves and feedback ’ 
encoders is necessary. Further, partial digital servo loops suid/or multi- 
plexed monitoring are state-of-the-art but are not cost competitive with 
analog. Consequently, conventional analog servo loops are recommended 
for ATT. 
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Redundancy Management Considerations 

All of the actuator approaches described are applicable to rediindant 
systems, but the redundancy management has hot been discussed. The 
factors to be considered in that management are: 

" . C 

• Output summing of driver actuators 

• Crossfeed implementation 

• Equalization or synchronization 

• Monitoring and monitoring logic 

Output summing . - The outputs of redundant driver or surface 
actuators may be summed or combined in several ways: position, velocity, 
or force. Position summing is illustrated in Figure 24 which shows an 
arrangement where two or more actuators are interconnected by means of 
conventional summing linkages. This allows each channel actuator to take 
a position independent of the other channel positions, and the net output is 
the average of all the inputs. 

There are three inherent weaknesses in such a position- summing 
system: (1) failure transients from hardover failures in any one channel 
are simply transmitted through to the output; (2) a failed channel actuator 
must be disengaged to sorrie predetermined position immediately; the ' 
synchronization and velocity control for this disengagement can also cause 
transients to appear at the output; and (3) the positional gains and 
authority of the remaining channel actuators must be increased once a 
failtme has been detected and corrected if the output positional relationship 
is to remain the same. These factors, plus the lack of reliability of the 
complex linkage have made the position- summing implementation unaccept- 
able to most users. 

A vairiation of position summing is the use of redundant, or "split” 
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Figure 24. - Position Summing 


surfaces with single- channel integrated actuators as shown in Figtire 25. 
Failure, of a given channel or actuator requires that the surface be 
disengaged to a streamline or neutral position. In the case of large, fast 
vehicles, this centering mechanism can be a heavy, complex mechanism. 

In addition, partial loss of control- surface area can reduce control 
capability at approach speeds. 

Velocity summing is a method of summing actuators in which the. 
prime mover is a rotary motor; a typical application would be a 
r.edxmdant electromechanical driver actuator as shown in Figure 26. Be- 
cause the end summation is a form of position svimming, the same criticisms 
that are presented for position summing are applicable here -- gains must be 
changed, and locking mechanisms must be employed in the individual channels. 
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Force summing has been the most popular method employed to 
date; all channel actuators have their output shafts firmly connected together 
so that the output force is the sum of all the channel actuator forces as 
shown in Figure 27. While jamming of any single cylinder can result in 
jamming of the entire driver actuator, the individual pistons are designed 
with area sufficient to minimize such a possibility. Disengagement of any 
single cylinder is accomplished by bypassing, and no change in positional 
gain or authority occurs. Force summing can also be used directly in 
surface actuators, where the control surface can be built to withstand any 
channel-to- channel force fights. 

Crossfeed and equalization . - While the output of a force- summed 
driver actuator coupled into the input of a surface actuator is essentially a 
mechanical crossfeed, it is also advantageous to effect an electrical 
crossfeed somewhere near the input to the actuator servo loop. This results 
in all of the channels being commanded by the same signal, and the only 
interchannel differences are the result of servoactuator errors or failures. 
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Figure 26. - Velocity-Summed Electromechanical Servoactuator 























Equalization or s 3 rnchronization is defined as the technique to make 
the output of all channel cylinders in an actuator configuration equal. 
Position- summed systems do not reqiaire any equalization because the output 
from each channel actuator is free to take the position of the input. In a 
velocity- summed actuator, the difference in the velocity of any two channel 
motors can be detected and used as an equalizing feedback signal. 

In a force- svimmed actuator some form of equalization must be used 
which will minimize the effects of interchannel differences. For example: 
even if identical command signals are used for each channel, minor 
differences due to feedback nonlinearities valve offsets, etc. , can occur 
and cause channel mistracking. 

Hydraulic servoactuators are capable of nearly infinite force gain. 

By using certain electrohydraulic servovalves, this gain may be reduced 
to any desired amount; and, in some force- sximmed driver actuator configu- 
rations, the force gain is reduced by an amount sufficient to accomodate 
the individual ch 2 umel errors within the maxim\im output force capabilities 
of the actuator. The trades associated with this approach are shown in 
Figure 28. In others, two different force gains are used to provide a 
"middle- select” function, and the output position is the position of that 
"mid-value" chsumel. 



MAXIMUM CHANNEL-T 0-CHANNEL DIFFERENCE 


Figure 28. - Limits of "Lowered Force Gain" Type Equalization 
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Reduction in the force gain of a hydratilic driver actuator has some 
negative aspects: while the load on the driver is normally quite low, 
widely-variable loads, such as "stiction”, friction, power valve flow forces, 
and power valve "jams” can cause positional errors, so that special inter- 
connects of the monitoring logic must be used. Obviously, reductions in 
force gains are intolerable for most surface- actuator applications, so this 
approach is usually limited to driver actuators. 

Force- siunming can be used in another variation; if one channel is 
defined as being "actiye” and (by design) has nearly infinite force gain> - 
the remaining channels can be made to "follow" that active channel by ? 
using negative-i^gh-gain, force feedback. This is easy to accomplish with 
pressure transducers in the follower or "on-line" channels. This 
implementation is described as "active /on- line" and is compared with an 
"active" implementation in the following paragraph. 

Active versus active /on-line actuators. - As a means of imple- 
menting the best characteristics of both the active and standby concepts, 
a force- summed servo configuration as shown in Figxire 29 was defined 
and is referred to as "active /on-line". 

One channel operates fully active and at high force gain. The 
redundant channels are engaged and operated in an active on-line mode. 

A pressure feedback loop is closed aroimd the actuator electrically 
through the EHV. Tins feedback operates functionally as a bypass orifice 
between the active and on-line channels. Upon failure of the active channel, 
that valve is disengaged and the piston bypassed. Simultaneously, pressure 
feedback is switched out from one on-line channel, making that actuator 
the controlling actuator. 

Since the pressure feedback functions to equalize out mistrack 
error between the active and on-line channel, the authority of the pressime 
feedback can be limited. In this way the on-line channels will load- share 
and/or oppose a failed active channel as soon as the limit is exceeded. 
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Figure 29. - Active /On- Line Actuator Concept Block Diagram 
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Continuous monitoring of the on-line channels is also an advantage* 
an in-line monitoring system used with this concept can detect failures in the 
failed on-line channel and disengage that channel without significant transients;' 

The pressure feedback is also designed to be frequency selective. The ; 
lower-frequency, large -amplitude commands that generate large mistrack 
errors such as stick inputs are equalized by a high static-pressiire gain. • 
Changes restilting from servo loop failures are partially inhibited by thie 
lagged pressure feedback. In this way the on-line channels tend to load-share . 
and will oppose a failure in the active channel. Characteristics of the active/ 
On-line concepts are compared with active redundancy in Table 16. 

Mistrack effects in the on-line channels are removed by this same 
pressure feedback. These channels are fully operable in all other respects 
and are continuously monitored. Upon failxire of the priority or active 
channel, the pressure feedback is switched off in one of the on-line channels, 
and that channel becomes the "active" controlling channel. Simultaneously, 
the active channel is bypassed and disengaged. Electronic switching of the 
on-line channel occurs almost instantaneously and is not subject to delays 
associated with solenoid-operated valves. 

Active versus standby redundancy . - Another concept adaptable to 
direct integrated surface actuation and one which is closely related to the 
active /on-line concept is that of "active /standby". In this system, one channel 
is also preselected as the active channel, and the remaining channels are held 
in "standby". While the electrohydraulic servovalves of the standby channels 
may be operational for monitoring purposes, the actuator cylinders are by- 
passed to add no load to the system. Equalization is only necessary to mini- 
mize switching transients or as an aid in monitoring. 

This tradeoff considered active and standby redundancy as applied to 
driver actuators or power actuators. The general tradeoff considerations for 
active versus standby are summarized in Table 17. 
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TABLE 16. COMPARISON OF ACTIVE WITH ACTIVE/ON-LINE 

REDUNDANCY 


Characteristic 

Active 

Active /on-line 

Load sharing 

Yes 

Yes ^ (high frequencies) 

Failure transients reduced by . 

Yes 

Yes^ (partial) 

load sharing 



Capability to function with an 

Yes 

Yes ^ (degraded per- 

undetected failure 


formance) 

Non-time-critical failure switching 

Yes 

Yes ^ 

Continuous pnonitoring of redundant 

Yes 

Yes 

channels possible 



High stiffness possible 

No 

Yes 

Cross-channel equalization 

No 

Yes 

eliminated 


- 

Capability to bypass jams 

No 

Yes 

Low /lower cost actuator 

No 

Yes 


^ These items are a compromise and do not meet the 
same level as a fully active system. 
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TABLE 17, - COMPARISON OF ACTIVE VERSUS STANDBY REDUNDANCY 


Characteristic 

Driver actuator 

Integrated power actuator 

Active 

Standby 

Active 

Standby 

Load sharing 

Yes 

No 

Yes 

No 

Failure transients reduced by load sharing 

Yes 

No 

Yes 

No 

Capability to function with an undetected 
failure 

Yes 

No 

Yes 

No 

Non -time-critical failure switching 

Yes 

No 

Yes 

No 

Continuous monitoring of redundant 
channels possible 

Yes 

No 

Yes 

No 

High stiffness possible 

Adequate 

Yes 

No 

Yes 

Cross-channel equalization eliminated 

No 

Yes 

No 

Yes 

Capability to bypass jams 

No 

No 

Yes 

Yes 

Low /lower cost servo possible 

No 

■ , «■ I 

No 

No 

Yes 




A pure standby configuration with a single active channel as applied to 
ATT has the basic problem of vinacceptable failure transients* Because the 
standby channels are not load- sharing, they cannot oppose a failure in the 
active channel. Therefore, total and rapid failure detection is required to 
accomplish transfer. An additional problem is the inability to determine 
whether or not a standby channel is operable prior to engagement. 

The primary reason for considering a standby configuration is the 
possible circumvention of inaccuracies resulting from summing the active 
channels. To solve active redundancy problems of "force fight" and "velocity 
fight", equalization is required which significantly complicates the design. 
Further, for power actuator applications, standby redundancy offers the 
potential of a jam-proof valve protection; i. e. , jammed valves can be by- 
passed upon failure. 

As a resvilt of the tradeoffs summarized in Table 17, the following 
conclusions were drawn: 

• Pure standby is not satisfactory for the ATT fly-by-wire actuator. 

The relatively larger failure transients and the use of "hair trigger" 
monitors and consequent high nuisance trip probability would be 
unacceptable. 

• Implementation of the "integrated actuator" with active redundancy 
force summing using equalization techniques is not expected to be 
feasible. High stiffness is not possible. 

• Other combinations of active and standby redundancy shoiild be 
considered to better achieve benefits offered by standby. 

Monitoring. - In a redundant actuation system, monitoring of the 
individual channels is necesseiry to remove the failed components when a 
failure occurs. It would be desirable to arrange the system so that the detec- 
tion of failures is non-time- critical;, that is, if a single failure occurs, it will 
have iittle or -no effect on the system if the failed component is not disengaged. 
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Should the failure be transient in nature, the component can then resume 
normal operation when the failure disappears. If the failure is "hard" and ; 
remains in a failed state, the monitoring logic will disengage the faulty 
channel, thus reconfiguring the redundancy set to be ready for any subsequent 
failures. 

Generally speaking, monitoring of the actuation system can be divided 
into two general types: comparison and in-line monitoring. Comparison 
monitoring, wherein any /one channel is compared to one or more identical 'v 
parallel channels to determine a failure, requires a minimum of four channels 
for a dual-fail- operational system. On the other hand, because in-line moni- 
toring can be accomplished wholly within the individual channel, three chanr 
nels of in-line monitored actuators are adequate for dual- fail- operational 
performance. 

Comparison monitored four-channel systems are applicable to position- 
summed systems (including split surface configurations), and velocity- sxammed 
systems, as well as force- summed drivers. In a position- svimmed actuation 
system, the output positions of all of the channel actuators only need be com- 
pared to each other, and a failure can be identified (or defined) when a pre- 
determined difference occurs. The. same techniques, compared with the indi- 
vidual channel motor velocities, can be used to identify failures in a velocity- 
summed electromechanical driver actuator. 

Force- summed hydraulic driver actuators (with proper equalization 
techniques applied) are relatively easy to monitor by comparison methods. 

If the assumption is made that the potential force output of the actuator is 
large relative to the required loads, then (ignoring the loads) the force pro- 
duced by any one channel is equal to the sum of the forces produced by all the 
other channels. It follows then that if a failvire should occur in one channel 
so that all of the other channels disagree with it, the failed channel will 
produce nearly maximum output force (assuming a relatively high force gain 
in each of the servoactuator loops). This high force can simply be detected 
with a pressure switch, eliminating any need for inter channel wiring. Again, 
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the level to which that pressure swtich is set depends on the type of equali- 
zation employed; in some systemsi an electronic limit on the equalization 
signal can replace the switch. In most cases, however, the logic must be 
^/arranged to negate the identification of a failure if all channels experience a 
high pressure (such as that needed to break a jammed servovalve loose). 

In-line monitoring of an electrohydraulic servoactuator can be 
accomplished by modeling the servoamplifier, by using a transducer on the 
spool of the electrohydraulic servovalve, and by load pressure sensing. The 
relationships between the valve natural frequency and the minimum delay 
needed to positively identify a failed servovalve is shown in Figure 30 where 
ip ^ positive valve current, i^ = negative valve current, xp = positive spool 
motion and x^ = negative spool displacement. 

If the pressure feedback in an active /on-line actuator is properly 
shaped, the on-line actuators can provide d 30 iamic stiffening of the entire 
actuation system; this stiffening significantly reduces the magnitude of the 
transients resulting from a failure. This transient is also reduced by 
eliminating all hydraulic and mechanical switching elements from the sequence 
which converts on-line actuator to active -- only the high-gain pressure feed- 
back need be removed in order to accomplish the status change. 

In contrast, the active /standby actuation system (which also can use 
in-line monitoring of the servovalve and amplifier), needs a mechanical shift 
of hydraxilic valves to change the status of a standby channel to active. 

The advantage of these in-line monitored systems are that they can 
meet the failure-mode requirements with only three channels instead of four, 
and they consequently require only three hydraulic power sources. Because 
of their insensitivity to load, they can operate directly as integrated surface 
actuators. 

Fom* actuator channels in a three- engine aircraft. - When it is 
desirable to use a four-channel FBW system in a three-engined aircraft, some 
special considerations in hydraulic power distribution must be considered. 
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FAIL * (Ip • Xp) + «„, • 

ip = 1 FOR POSITIVE 1 1 I >A ma 

Xp = 1 FOR POSITIVE VALVE 1 X | <0.006 IN. 

ij,= 1 FOR NECJATIVE 1 1 j >4 ma 

Xf^ = l FOR NEGATIVE VALVE |X | <0.006 IN. 



4 IN/SEC 
RATE LIMIT 


LINEAR VALVE 


Figure 30. - 
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If foiiT'Channel electrohydraulic driver actuators are desired, it is best 
from the reliability standpoint to use four separate hydraulic supplies. This 
number of supplies can be driven by three engines, but the niunber of p\imps 
per engine becomes formidable; if each system requires two pumps, the net 
needs are for eight pumps on three engines. 

Other solutions to this problem are to use three hydraulic systems 
for the surface actuators and the same three for three channels of the driver. 

A small, electrically powered system for the remaining driver actuator 
channel could be left "off" until a failure of one of the initial three channels 
was experienced. Or, a fourth hydraulic supply could be "shuttled in" from 
the known active of the three supplies. This latter solution can be accomplished 
with miniature motor /pump units if isolation is a firm requirement. 

There are many other possibilities because the actual amount of « 
hydraulic power required for operating only one channel of driver actuators is 
very low — on the order of 0. 1 hp per actuator, which may be compatible 
with cost-effective hydraulic units. 


AIR DATA COMPUTATION 

In all probability, air data computation will take place in a digital 
processor remotely located from the sensor elements. The primary sensor 
configurations are listed in Table 18. All are presently in use, and it is 
anticipated that they will continue in usage in the 1980 time period with minor 
performeince improvements. 
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TABLE 18. - SENSOR CONFIGURATIONS 


Component 

Comments 

Strain gage 
pressure sensor 

Output: Analog, converted to 16 bit digital word 
in processor electronics "" ' 

Acciiracy: 15/32 000 milli-inches hg with ■ 

temperature compensation ’ ' 

Improvements: Direct strain gage heating to 
eliminate compensation 

Vibrating wire 
pressure sensor. 

* » 

Output: Variable frequency, converted to digital 
word in processor electronics 
Accuracy: 15/32 000 milli-inches hg with 
temperature compensation 

Vibrating diaphragm 
pressure sensor 

Output: Variable frequency, converted to 
digital word 

Accuracy: 15/32 000 milli-inches hg with 
temperature compensation 

Temperature sensor 
platinum resistance 

Output: Analog, dc converted to 10-11 bit 
digital word 
AccTiracy: ±0. 5°C 

Redundancy: 

Multiple sensors and computation electronics 
as needed 

Self test: 

High and low end of range limit tests, as well as 
computation electronics accviracy (stored 
constants, etc. ) 

Failure monitor: 

High and low end of range test. 


124 

















DISPLAYS 


i 

, The problems of limited p^el space and increasing -workioad are 
relieved by the recent, trend toward multimode or time- shared displays. 
Digitally integrated avionics control-display systems will provide the effi- 
ciency and flexibility desirable for the high-performance ATT. 

Digital programmable displays and controls are capable of being driven 
by a digital computer, seiisor or programmable memory. The display must 
be capable of alphanumeric, graphic and TV presentations. The display 
technologies which appear most promising for the 1978-1980 time Span are 
listed in Table 19. 


TABLE 19. - DISPLAY TECHNOLOGIES 


Component 

Comments 

Cathode ray tube 
(analog) 

The conventional single beam-yoke type cathode ray 
tube with analog inductive beam sweep has been one 
of the most common displays. The analog CRT will 
undoubtedly be improved in the future; however, it has 
the disadvantages of high weight, high power dissipation, 
high volume and low reliability. 

Flat -panel display 

“h . 

A flat-panel digital-addressable matrix display appears 
the mo^ desirable configuration for ATT. It is the 
most efficient physical package and can readily be 
integrated with the various other cockpit displays. 

Flat CRT 

A multiple-beam flat CRT display has been highly 
developed by Northrup. It is relatively reliable, 
adaptable to gray scale, color and inherent storage. 

It is rugged and low-cost; however, it requires too 
much power to overcome high ambient lighting, needs 
high voltages, arc suppression and protection. 
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TABLE 19. - DISPLAY TECHNOLOGIES - Concluded 


Component Comments 

LED display 

A stackable module LED display has been developed by 
Litton. Its inherent disadvantages include inefficiency/.' 
in generating light, poor resolution, high power, poorr 
coiitrast and high cost. 

Plasma panel 

The "Digivue" plasma panel has been highly developed 
by Owens-Illinois. The plasma panel is not inhe^ently’^ 
suitable for vector graphic and pictorial-type displays. 
The plasma discharge is not throttleable and the i 

resulting color is limited. 

Luminescent panels 

Electroluminescent panels have had problems with 
limitation of brightness, short operating life, high 
voltage, and poor resolution. 

Liquid crystals 

Liquid crystals require very low power, provide good 
resolution and have an inherent immunity to variations 
in ambient light. Its principal disadvantage is a limited 
operating temperature range of approximately 50°C. 


ELECTRONICS 

/r ' 


Solid-state electronic component development is presently at a point 
of very rapid change. The direction of the industry's development thrust may 
change in the near term and cause large disparities in five-year technology 
projections. The technology survey represents the best projection following 
the trends apparent today. 
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Integrated Circuit Technology 


\ 

\ 

It has been concluded that C/MOS integrated circuit technology is the 
best suited for the ATT implementation. The present and future state-of-the- 
art of C/MOS shows that capability of maintaining the pace of TTL in function, 
complexity and electronic dependability. 

• The following were the bases for recommending C/MOS over other 
forms of MOS and TTL. 

• The cost of C/MOS is ctmrently somewhat higher than for P/MOS 
and TTL; however, projections for the 1978-1985 time frame indicate 
this situation will reverse. 

• C/MOS offers development flexibility via a large variety of standard 
circuits, for ease of breadboarding and computer-aided design to 
facilitate customizing circuitry. 

• The alternate applications of SSIC, MSIC or LSIC provide production 
flexibility. 

• C/MOS requires minimum fan-in and fan-out restrictions. 

• C/MOS has the lowest power requirements. 

• The single operating voltage required by C/MOS simplifies power 
supplies. 

• The transient-tolersuit characteristics of C/MOS encourage its appli- 
cation in high-noise environments. 


Multiple sources of C/MOS circuitry are being expanded with extended 
lists of vendors. 



Large-scale integrated circuits. - LSIC provides a system reliability 
improvement as compared with SSIC and MSIC because of reduced total parts 
count and minimized interconnections.' Volume, weight and cost reductions 
with LSIC are significant. > ^ 

P-channel metal oxide semiconductor devices (P/MOS) . - P/MOS 
devices provide the highest-possible-density LSIC packaging. Density is 
usually limited by the pin-out requirements. P/MOS requires custom design 
at present as it is not available in standard SSIC and MSIC. 


High-Efficiency Line-Operated Ultrasonic Inverter • ' 

It is advantageous that each redundant channel of the PCS be supplied 
by a completely independent ultrasonic power converter which will operate 
directly off the three-phase line and supply the ±d-c voltages required. The 
general circmt approach of using high-frequency power conversion techniques 
in place of conventional 60-Hz transformer supplies results in reduction in 
size and weight, high efficiency, lower cooling requirements, improved 
regulation, higher reliability and possible application of high- frequency- 
excited sensors. The line-operated ultrasonic inverter is excited from a 
three-phase line to provide additional reliability through the inherent redun- 
dancy of the three-phase source. Single-phase failures do not affect output 
voltages. ’Honeywell has used this technique in the Space Shuttle Engine 
ContrOr program and achieved efficiencies of approximately 80 percent. 

High-voltage power transistors . - The current (8 amps) and breakdown 
rating (700 volts) of new triple-diffused silicon power transistors have dras- 
tically improved power switching capability. 

Monolithic Darlington power transistors . - The improvement in 
efficiency offered by high-voltage monolithic Darlington transistor switches 
such as TRW's SVT6000 makes possible the line-operated inverter. 
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Stitch- Wired PC Boards 


Si . The stitch-wired PC board technique permits component densities 
equivalent to 8- to 12- layer PC boards. It allows design change and repair 
flexibility while holding down design, drafting and production tooling costs. 


SENSORS 


The candidate system concepts require three types of sensors; 
angxolar rate, linear acceleration, and position transducers. The position 
transducers are used for electrical wheel, columns, and^edal-position 
commands to the PCS and for actuator position feedbacks. While other sensors 
were considered in the study technology survey, only these three sensor types 
were applicable to the PCS concepts traded. The attitude sensors and air 
data sensors. are considered to be part of other systems such as the navigation 
system or the central air data system, and, while these outputs are utilized 
by the PCS as interfacing sensor data or as computed data, they should be 
independent of the PCS. 

Por these same reasons, inertial-quality integrating rate sensors and 
accelerometers were not advanced into the system concept trade study. It is 
anticipated that some aircraft-user configurations will not include an inertial 
navigator as standard equipment. Consequently, a PCS providing inertial- 
quality rate/acceleration sensing is too capable and vmnecessarily expensive 
for these user configurations. Thus, the concept, systems studies require 
only control- quality sensed data for rate and acceleration. 

The following paragraphs describe the various areas of sensor trade- 
off and the applicable technology survey results. 


129 



Position Pickoff Sensors r,> 

' ■ .. . •': £ 1 ; 

Several types of position sensors vrere initially considered for this^* 
application: 

• A-C linear pickoff s — "synchros'* 

• D-C potentiometer pickoff s 

• Optical shaft encoders 

The use of shaft encoders was rejected because their cost was, at the 
best, ten times that for a "synchro" pickoff and with inferior reliability. The 
prime advantage of the encoder, that of not requiring an A/D converter to 
interface with a digital processor, was of insignificant value in this system 
because the computation units required A/D converters for other analog 
sensors. 

The use of d-c potentiometer pickoff s was seriously considered because 
the elimination of the demodulator-amplifiers required with a-c pickoffs 
appeared advantageous. However, the high initial cost of d-c potentiometer 
pickoffs, their relatively low reliability due to wearout and frictional polymer 
buildup, and the problems of fault propagation between multiple users and 
common-mode voltage offsets, all combined to eliminate them from the trade 
study sequence. 

The a-c linear pickoffs were chosen for all position sensor applicationjs, 
for wheel, column and pedal position, for actuator position, and for panel 
inputs such as roU/yaw trim commands. 

Angular Rate Sensors 

A great number of angtilar rate sensing concepts were considered in 
the preliminary survey -- electrostatiq, integrating gyros, conventional 
spring-restrained gyros with ball bearings and with air bearings, niagneto 
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hydrodynamic sensor, vibrating wire rate sensors, and an implementation of 
the laser rate gyro. Of those surveyed, the most promising sensors for the 
tim#<frame of interest were the conventional spring-restrained ball bearing 
rate gyro, the laser rate sensor and the magneto hydrodynamic sensor^ 

The laser sensor holds promise as a rate sensor because of its very 
high reliability and lack of wearout characteristics. The laser gyro has been 
developed basically as a navigation sensor, and the principles of operation 
and the special implementation considerations are explained in some detail 
in the Honeywell Document No. ,.7040-333.2 "The Honeywell Laser Gyro", 
available through the G&AP Division. 

The magn^o hydrodynamic (MHD) Sensor was continued intp the trade 
study because a single sensor senses angular rate about two orthogonal axes. 
The sensor also projects a very high reliability; presently, however, the slip- 
ring wearout requires a 1500-hour time between scheduled replacement. The 
MHD sensor can be rebuilt easily by replacing the sliprings. 

The MHD rate sensor is a non- gyro sensor. . That is, it does not 
depend on the momentum of a. spinning wheel for its operation. The MHD 
rate sensor instead uses an angular accelerometer in the form of a torus of 
liquid metal as its basic sensor. The MHD implementation in the: GG2500 
sensor is shown in Figure 31 and its theory of operation in Figure 32. . 

Angular accelerations about an axis normal to the place of the .liquid 
metal torus result in motion of the case and magnetic field relative to the 
liquid metaL This disturbance is sensed by nieasuring the voltage that is 
generated in the liquid metal moving in the presence of a magnetic field. The 
science dealing with this phenomenon is called magneto hydrodynamics, and, 
therefore, the device is referred to as an MHD rate sensor. 

The mechanization of the .MHD rate sensor _includes a technique 
wherein.the .Uquid metal torus .is pontinuou sly rotated along a diameter of the. j, 
torus. This rotation permits the device to measur.e angular rate instead, of . 
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angular acceleration and to sense in two axes instead of in a single axis. 

With the continuous rotation, each of two input axes is sampled in the positive 
and negative directions during each revolution. 

To obtain further insight into the operation, consider an angular 
accelerometer which is being rotated at a constant, rate, cu , about an axis 
perpendicular to the angular .accelerometer input axis^ If a rate exists perpen- 
dicular to this rotation axis, the instantaneous rate about the angulair accel- 
erometer input tois'is 

. uu = uu sinuu^t (see Figxire 32). 
o X s 

The angular acceleration about the input axis, therefore, is 

duu 

^o 

By these means the input rate is changed to a time-varying angular 
acceleration. 

The angular accelerometer used in the MHD device is shown in 
Figure 33. An annular ring of liquid rhetal exists between the radially 
oriented permanent magnet and the magnetic case which provides the magnetic 



Figure 33. - Angular Accelerometer 
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path. A spool of conducting material contacts the liquid metal and encom- 
passes a toroidal tape-wound core. The existence of a rate input results in sin 
oscillation of the magnetic field with respect to the liquid metal. The 
relative motion generates a voltage in the single turn represented by the liquid 
metal and conductive spool. This generated voltage induces a corresponding 
voltage in the secondary winding which is wound about the tape-wound core. 

The voltage induced in the liquid metal is 

E = B 1 V 

where 


B = flux density 
1 = length of moving conductor 

V = velocity -of conductor relative to the magnetic field 

In terms of angular velocity 

e = B 1 (ju r 
r 

where 


r = mean radius of the liquid metal 

u)^ = angular velocity of the liquid metal relative to the 

magnetic field (or sensor case) . 

To determine the relationship between and the input angular rate 
the open-loop transfer function for the angular accelerometer is 
examined: 
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where 

, •; X ii) = as defined above 

r 

u)^ = angular input to case 

i' V I = polar moment of inertia of liquid metal 

; •( C '= damping of liquid metal 

In the practical case where i S is much greater than one, the quantity 

7 

within the parentheses is unity to within one part in 10 . This means that the 
input rate and the rate between the magnetic field and the liquid metal are 
essentially identical and that the liquid metal is motionless about its input 
axis. Thus, the output of the MHD rate sensor is a true representation of the 
input rate. 

Since the variation of I and C over the operating temperature range 
has little or no effect on the output, temperature control to hold these para- 
meters is not necessary. 

The complete rate sensor consists of the above described angular 
accelerometer, a syncronous hysteresis drive motor, a two-phase reference 
generator which permits resolution of the output into its two orthogonal axes, 
and a slipring assembly to transfer the output signal from the rotating element 
to the preamplifier mounted within the hermetic seals. 

The conventional rate sensor is represented in the trade studies by the 
Honeywell GG445. The GG445 is one of a family of subminiature devices which 
has been tested extensively under a wide variety of environmental conditions. 
These devices have a proven ability to perform as required under temperature 
extremes of -!-65°F to 200°F, vibration levels of 20 g and shock levels of 400 g. 
The GG445 is a spring-restrained, fluid-damped, rate-measuring gyroscope 
■with a synchronous hysteresis a-c spin-motor and an angvilar variable- 
differential transformer pickoff. The variable-reluctance pickoff provides 
high sensitivity, low noise and excellent linearity. This gyro has a simple 
low-cost self-compensated damper arrangement which maintains the damping 
ratio within 0. 6± 0. 2 over the required temperature range. 
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The balance of the rate sensor types surveyed were eliminated from 
fiirther study either because of very high projected initial cost/cost of owner- 
ship, or because of high development risk in the 1978 time frame. 


Linear Acceleration Sensors 

The technology survey found considerably fewer linear acceleration 
implementations under development. The ordinary spring-mass accelerometer, 
either mechanically or magnetically damped, was eliminated because of high 
cost, low performance, and poor reliability. The pendulous silicon beam- 
strain gauge accelerometer was rejected for fragility at the low g-levels to 
be sensed. Pendulous force- rebalance devices were the only type considered 
suitable, and only the control- quality device was found to have a suitable 
initial CQSt/cost of ownership. The inertial- quality pendulous accelerometers 
were foxmd to be extremely expensive. The sensor chosen as representative 
of the great number of force rebalance types was the Honeywell GG326. 

This unit has a high reliability, has no wearout modes, and is fully capable 
for the functional requirement of the ATT. 

The GG326 accelerometer is a conventional force rebalance device 
with a unique mechanization resulting in low cost and high accuracy with 
time and environmental exposure. The pendulum and suspension are fabri- 
cated from quartz fibers as shown schematically in Figure 34. 

A thin film of silver is vapor deposited over the quartz suspension and 
pendulvim. The base of the pendulum operates in a permanent -magnet field, 
providing a ohe-tum torque generator. The null detector consists of a light 
source arid a dual silicon photodiode. The p-layer of the silicon p-n junction 
is dividied into two parts by a thin separation. When the base of the pendulum 
coincides with this separation, the null position is achieved, and the d-c out- 
puts of the dual photodiode are balanced. The servo amplifier used to control 
the pendulum to the null position is a standard commercial mA 741 integrated 
circuit. This straightforward amplifier (seven low-power discrete components) 
is capable of controlling the accelerometer over a range of ±3 g's. 
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LAMP 



Figure 34. - GG326 Linear Accelerometer 


The operational life of a tungsten filament lamp varies as the 12th 
power of the excitation voltage. The lamp used in the GG326 is rated for a 
useful life in excess of 20 000 hours. Severe environmental conditions have 
been applied to the GG326 accelerometer both in test and in the field with no 
lamp or suspension failures. 


Skewed Sensor Arrays 

In system concepts which included a general-purpose digital processor, 
the use of skewed sensor arrays may provide a significant redundancy manage- 
ment advantege. A digital processor is nearly mandatory because of the 
difficulty in accimately converting the skewed sensor data to the required 
orthogonal set for aircraft control in an analog computation implementation. 
Because of the great advantages of reducing the total sensor count in redun- 
dant systems, the skewed sensor arrays were included in the trade study 
configurations. 

Conventional flight control, attitude reference, and inertial systems 
have normally used orthogonal triads of gyros and accelerometers to obtain 
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three*axis rate, attitude and/or velocity information. Redundant systems 
have been mechanized simply by duplicating the triads as necessary. The 
skewed sensor configurations are based on two assiunptions -> that sensed 
information (angular displacement or acceleration) is equally important from 
all directions and that sensor accvmacy is acceleration- or gravity- independent. 
Under this assumptions, it can be shown that sensors whose sensitive input 
axes are placed normal to the faces of regular polyhedra, which divide the 
3-space into equal regions, comprise optimum systems. " 

Expected system accuracy is statistical in nature and improves with 

the number of sensors employed. System variance or mean radial ^variance 

is determined by integrating and averaging the variance over the entire 3- 

■2 

space. For sensors with zero means and with equal Variances (a ), the mean 
2 

variance (a ) of an optimally oriented n sensor array can be shown to be 
2 2 /n ^ 

= 3ct ' . It can further be shown that n sensors, n ^ 3, equally spaced 
aroimd a cone with central half angle, 6 = cos“^ 1/^3^ comprise an optimum 
system in that system variance is minimized. Figure 35 shows examples of 
these class I arrays. Other minimum-variance arrays may be developed to 
provide optimum systems which are particularily compatible with certain 
sensors. The optimiim quadrad is ideal for laser gyros since, being half of 
a regular octad, its normal faces are equilateral triangles. The other half 
of the octad could be used for placement of accelerometers. Thus, an entire 
redundant inertial system can be compactly housed in a regular octad 
configuration. , , 

Table 20 includes a siimmary of the processing equations and relative 
accuracy for a large number of optimum arrays. 

Skewed redundainf Sensor arrays offer a number of significant advan- 
tages as discussed in the following paragraphs. 

Reliability. - The skewed redundant strapped-down array is an efficient 
means for increasing reliability. The desired reliability level dictates the 
number of sensors which must be used in a system. The dual (or triple) 
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(a) ORTHOGONAL TRIAD 




(b) TETRAD (OCTAHEDRON) 



(d) HEXAO 

(TWO ORTHOGONAL TRIADS) 


Equally Spaced on a 54. 75-deg Cone 
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Figure 35. - Class I Optimum Arrays, 



TABLE 20. - PROCESSING EQUATIONS AND ACCURACY SUMMARY 
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TABLE 20. - PROCESSING EQUATIONS AND 
ACCURACY SUMMARY - Concluded 
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redundancy of a five- (or six-) sensor array may be necessary to achieve the 
prescribed reliability level. Since the effective redundancy of dual or triple 
orthogonal sets may be achieved with pentad or hexad arrays which require 
fewer sensors, the overall system reliability is improved by the deletion of 
these relatively less reliable devices. 

Fault detection and isolation. - Three non-coplanar sensors are neces- 
sary to provide full three-axis information in ovir three-dimensional space. 
Addition of a fourth sensor, not aligned with any of the other three, to com- 
plete a tetrad, provides fault -detection capability. This configuration, 
however, is insufficient to provide fault isolation; that is, a fault can be 
detected by noting a disagreement among the outputs of the sensors, but the 
failed sensor cannot be identified. 

The addition of a fifth sensor completes a pentad, no three sensors of 
which are coplanar, which can provide positive fault isolation as well as 
detection, by using a voting technique among the ten triads. That is, assuming 
failvire of a single sensor, the four triads not involving the faulty sensor will 
continue to show agreement, while the other six which involve the faulty 
sensor will not. The same technique can be used to detect but not isolate a 
second sensor failure. 

The addition of a sixth sensor can provide two levels of fault-isolation 
capability, if desired. Although not required for fault isolation of a single 
failure, the addition of a sixth sensor to form a hexad proyides great'er accuracy 
and more reliable single-fault isolation capability since, , in effect, the outputs 
from 20 triads are compared and averaged in the parity and processing 
equations. These computational techniques also permit, the detection and 
isolation of the second sensor failxore in the hexad configuration. A third 
sensor failure will be detected but cannot be identified. 

Accuracy. - Expected system accuracy is statistical in nature and 
improves with the number of sensors employed. The relative improvement 
per added sensor diminishes as the number of sensors increases. The 
greatest reduction in--mean variance, 25 percent, is realized in going from a 
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triad to a tetrad. Adding a fifth and sixth sensor results in a further reduction 
in mean variance by 15 percent and 10 percent, respectively. The relative 
acc\iracy of a number of typical redundant arrays is shown in Figure 36. 

When performing an accxiracy analysis, consideration must be given 
to the mean variance of the remaining arrays after one (or more) sensors have 
been removed from the various optimum arrays. In establishing system 
configurations, consideration must also be given to the relative computational 
difficulty in processing the sensor data of the various truncated arrangements 
as .well as the original arrays. 

Size and weight. - The strapped-down array offers a smaller and 
lighter configiiration than other sensor groupings. This is particularly true 
in comparison with gimbaled configurations such as have been commonly used 
in inertial systems. Kedimdant sets of orthogonal triads also suffer in 
comparison with the skewed array, as the array requires fewer sensors on a 
more compact mounting assembly, which requires less machining. 


PROCESSORS 


General-purpose processor capabilities anticipated in the 1978-1980 
time period were forecast for use as inputs to the overall ATT system con- 
figuration tradeoff task. Potential system configurations were reviewed to 
provide the general sizing requirements for use in the processor sxirvey. 
Configurations considered ranged from the large central processor type to the 
small distributed processor type, covering a very wide range of throughput 
capability. Sizing estimated for the ATT FCS functions indicated a total 
throughput requirement in the cirea of 500-600 KEOP and memory capacity of 
10-12K words, somewhat dependent on the redundant system configiiration. 
The approach taken in the technology survey was to estimate processor 
capability expected to be available in 1978 consistent with the above require- 
ments. Several key groundrules were established prior to conducting the 
sxirvey, as follows: 
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Figure 36. - Relative Accuracy of Redundant Arrays 
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The processor design must be relatively well proven, at least to the 
operating production prototype stage. Development of a general- pvir pose 
processor simultaneously with that of an advanced technology flight control 
system was considered to be an undesirable and unnecessary risk. Due to 
the complexities of the production process, this is particularly true for 
processors employing nonstandard LSI circuits. Production status is preferred 
in this case. 

The rate of change of processor speed improvement observed in the 
past ten years will not hold for the next four to five years, particularly for 
the smaller machines implemented in LSI technology. In the last several 
years, integrated circuit vendors have emphasized application and marketing 
in contrast to development. -New market areas such as the calculator, elec- 
tronic watches, automotive electronics, point-of-sale terminals, etc. , have 
captured the interest of the vendors due to the very high volume in these 
commercial applications. These markets require low-cost circuits and, 
consequently, integrated circuit developments are expected to be directed 
toward reducing cost rather than improving speed. 

Destructive-readoxit (DRO) memories, (e. g. , conventional coincident 
current core) are not considered suitable for production flight control system 
use due to the permanent alteration of program resulting from a transient 
during memory operations. 


Processor Trends 

Two different trends appear in current processor developments, 
dependent on the use of LSIC (large- scsQe integrated circuits). Several 
currently available processors use LSIC extensively to provide considerable 
computing power in a small package at low cost. Typically, this class of 
processor is intended for high- production- volume applications and low pro- 
duction cost is a major objective. Custom MOS circmt technology, requiring 
less chip area and lower power per function than bipolar, is used to obtain 
low cost. Unfortunately, MOS circuits are slower than bipolar and speed is 
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less despite use of parallel arithmetic and general register architectures. 
Since low cost is anticipated to have the highest priority in the application of 
such processors, computing speed increase by 1978 is expected to be limited 
to no more than a two-fold improvement. 

A different class of airborne processor currently available or imder 
development is that of a relatively "large", fast, sophisticated machine, as 
would be required for total aircraft avionic system processing. Here, the' 
overall, computing capability has a higher priority than low cost. Total * 
production volume is expected to be much lower since this processor is not 
suitable for commercial applications. To achieve speed, bipolar circuit 
technology is used. Since this processor will have low-volume production, 
LSIC use will be limited to "standard circuits". The cost of custoni bipolar 
LSIG is not warranted. Throughput on the order of 800 to 1000 KEOP is 
anticipated for this class of processor by 1978. Co^ will be significantly * 
higher than for the MOS LSIC processors. 

The MOS LSIC processors are expected in two capability or "size" 
brackets, termed "medium" and "small" in this study. A medium processor, 
using a 16-bit word length and full parallel arithmetic, can be packaged on a 
single PC board and is expected to provide 300 to 400 KEOP throughput. The 
small processor can be packaged on a partial PC board and is expected to 
provide 150 to 200 KEOP tliroughput. 

Processors with throughputs between the "large", "medium", and ^ 
"small" ranges above are not expected to be available in the 1978 time span. 
Processor desigri objectives are to produce maximvim machine capability 
consistent with the general application range and circuit technology used. 

Some combinations of serial-parallel arithmetic and bipolar technology 
might be used to produce a processor with an intermediate throughput in the 
area of 500 KEOP but, the market for such a machine appears very limited. 
With a limited market, a custom-designed processor would not be cost 
effective, and consequently custom-designed processors, tailored to a specific 
task such as ATT FCS, are not considered. 
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Projected Processor Characteristics 

General processor characteristics are summarized in Table 21. 
Detailed characteristics are provided in the following paragraphs. 


TABLE 21. - CENTRAL PROCESSORS CONSIDERED 



Capability 

(KEOP) 

Cost 

Word 

length 

Physical 

characteristics 

Small 

150- 200 

$2000 

16 bits 

(selectable in 
4-bit slices) 

Partial PC board 
LSI 

Medixun 

1 

300- 400 

$3000 

16 bits 

1 PC board - LSI 

Large 

800-1000 

$8000 

32 bits, 
floating point 

Multiple PC board 
SSI, MSI, LSI mix 


. Large processor . - A large airborne processor with throughput on 
the order of 800 to 1000 KEOP is anticipated by 1978. The general market 
objective is for a central processing machine implying a sophisticated design. 
The large processor itself, exclusive of I/O and memory, will utilize a mix . . 
of SSI, MSI, and LSI standard bipolar circuits mounted on six PC boards. 
Production volume is anticipated to be relatively small, resvilting in high unit 
cost — approximately $8000 each (exclusive of memory and I/O). Projected 
characteristics of the large processor are as follows: 


Char act er i Stic 
Gener al- pvu* po s e 
Microprogrammed 

i, * 

Speed of 800 to 1000 KEOP 


Parallel operation 


Rationale 

To provide application flexibility 
and optimization. 

Based on minimum operation times of: 
Add - 1 /usee 
Mult- 4 /usee • 

Provided to achieve speed. 
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Characteristic 


Rationale 


ROM/PROM instruction and constant 
and CMOS variable memory 

General register architecture 

Indexing 

V 16- and 32-bit word length 


2 

Fixed and floating-point, arithmetic 

Direct memory access (DMA) 

Mix of some LSIC, MSIC, & SSIC on 
multiple PC boards 


Semiconductor memory is relatively . 
cheap, NDRO, and available in alterable 
form. 

Provides high-speed inter-register 
operations. } ..-r 

Reduces memory requirements. 

16-bit adequate for most flight Control 
operations; 32 bit used for high fre- .. 
quency loops, navigation, floating 
point, etc. 

Floating-point provided to reduce 
programming costs. 

Reduces I/O load on processor time; 
Limited production volume and speed 
requirements will limit use of LSIC. 


Medium processor. - A medium airborne processor with throughput 
on the order or 300 to: 400. KEOP is anticipated by 1978. LSI MOS circuits 
will be used extensively to provide low cost and single-PC-board packaging. 
The medium- size processor speed forecast was obtained by extrapolating 
cxirrent LSI machine capabilities to 1978. Honeywell cxirrently manufactures 
such a processor. As originally designed, a throughput of 200 KEOP was, 
provided. Throughput of 300 to 400 KEOP is expected, however, as. a result 
of upgrading the circuit process technology and the use of new architectures. 
A large production volume is expected, providing a capable processor "at 
low unit cost -- approximatately $3000 exclusive of memory arid I/O. . Pro- 
jected processor chcu* act eristics are; 


Flight control applications, including the ATT, do not. require floating 
point. However, this class of machine probably will incorporate it since it is 
to be designed for limited- quantity applications where the nonrecurring cost 
of software is a significant part of program cost. 
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Rationale 


Characteristic 
General-pxorpose 
Speed of 300 to 400 KEOP 

Parallel operation 

ROM/ PROM instruction and constant 
and CMOS variable memory 
16-bit word length 

Fixed- point arithmetic with double- 
precision instructions 

Direct memory access (DMA) 

LSI circuits packaged on a single 
printed circuit board 


Based on minimum operation times of: 
Add - 2. 5 nsec 
Mult - 10 ^^sec 

To obtain maximum speed limited by 
circuit technology. 

Semiconductor memory is cheap, NDRO, 
and available in alterable form. 

Suitable for flight control (bit slice 
technology may be provided permitting 
word length adjustment). 

Suitable for flight control and other 
similar control tasks with double 
precision used in some portions. 

Reduces I/O load on processor time. 
Honeywell HDC-310 employs MOS 
LSI circuits on a single 6. 2x6. 5-in. 
printed circuit board. 


t; ' Small processor. - A small processor with throughput of 150 to 200 
KEOP is anticipated by 1978. .LSI MOS circuits will be used extensively to 
provide very low cost; packaging will be on a partial PC board. The small 
processor forecast was obtained by extrapolating from current production- 
status LSIC microprocessors, the National GP/CP being most representative. 
The GP/CP has recently gained production status in limited temperature 
range (0® to 70®C) form. The basic 16-bit processor, exclusive of memory, 
requires five LSI circuits (four 4-bit ALUs and one CROM) and additional 
buffering circuitry. The current instruction repertoire does not include 
wired MPY and DIV. National anticipates improvements in the next several 
years in the following areas: 

• Wired MPY, DIV, and other, logical instructions via an additional 
CROM (the GP/CP is microprogrammed via the CROM). 
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• A general speed increase of 40 to 80 percent over the current' 
GP/CP processor. 

• A temperature range capability suitable for airborne application 

via screening. > 


Microprocessors of this type will be applied in a wide variety of 
products, resulting in large production volume and low cost. Unit costs of 
approximately $2000 are anticipated, including the screening necessary to 
obtain circuits suitable for aircraft environments. Projected processor 
characteristics are as follows; 


' Characteristic 
General- p\irpose 
Microprogramming 


Parallel operation 
ROM /PROM instruction and 
constants and CMOS variable memory 
Indexing 

16-bit word 


Fixed- point eirithmetic 

LSI, MSI, and SSI circuits packaged 
on a partial printed circuit board. 


Rationale 

For application flexibility. Based on 
min. operation times of: 

Add - 5 /usee 
Mult. - 20 /usee 
Provided for speed 
Semiconductor memory is cheap, 

NDRO, and available in alterable form. 
Expands limited direct addressing 
range (256 words); saves memory 
Bit slice technique permits word 
lengths in increments of 4 bits; 16 is 
appropriate for most flight control 
tasks. ’ ■ 

Processor oriented toward "low-cost" 
market; thus, floating point not 
justifiable. 
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Incremental Versus Whole-Word Processor Implementation 

This subsection discusses relative suitability of incremental and whole- 
word, general-purpose computers for flight control. Results of a -study com- 
paring a digital differential analyzer versus a general-purpose computer for 
a typical fly-by-wire control system are included. 

The conventional digital differential analyzer (DDA) has long been 
considered the most likely candidate for computation of flight control equations. 

DDAs are particularly well suited for transfer function computations 
that require high iteration rates. They aire not well suited to engage logic 
and fault detection. Both of these functions are more practically attained via 
additional hard-wired logic. 

For engage logic, an implementation of the equations describing the 
mode- engage criteria is required as normally encountered in conventional 
analog autopilots. 

. Faxilt detection in DDAs is analogous to that for an analog configuration; 
i. e. , comparison monitoring is the most feasible technique. Two channels 
provide the ability to detect a fault, and three enable identifying the faulty 
channel and suppressing effects of the fault itself. 

Transfer function sizing rules for special-purpose machines herein, 
are restricted to integrator realizations that can be used on conventional 
DDAs. oFigure 37 illustrates the integrator realization and DDA map for the 
second-order/second-order transfer function and five of its more common 
special cases. 

The DDA maps shown in Figure 37 presume that multiplications by 
constants will be done with integrators. The general approach requires that 
they be included even though it is possible, under special circumstances, 
that some of them will not be required. Thus, the realizations in Figure 37 
should be considered an upper bound. 
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GENERALIZED TRANSFER FUNCTION 


STATE DIAGRAM REALIZATION 


CONVENTIONAL DDA REALIZATION 



Figure 37. - Integrator Realization of Transfer Functions 
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Figure 37. - Continued 




















The six transfer functions that are commonly encountered in flight 
control applications are listed in Table 2 along with the memory and time 
requirements for general-purpose implementation and integrator requirements 
for special-purpose (DDA) machines. 

There are nine nonlinear functions that are commonly encounted in 
flight control systems. These are listed in Table 3 along with general- and 
special-purpose machine requirements. 

Gain schedules are not as easy to implement on special-pxirpose (DDA) 
machines as they are on general-purpose machines. In fact, they cannot be 
implemented using integrators alone, just as is the case with analog computers. 
In analog computers, special devices such as diode slope generators, relay 
switches, threshold detectors, etc. , must be utilized to build special nonlinear 
gain control elements. The most straightforward way to mechanize this sort 
of nonlinearity would be to modify the constant in a constant multiplier. 

Almost all DBAs have a feature that permits this sort of operation. The exact 
method used depends upon the particular DDA model involved. About all that 
can be said in way of a general rule is that some additional hardware will be 
required. If the decision elements are built into the integrators, then addi- 
tional integrators will be required. 

The DDA integrator realization of a synchronizer is shown in Figure 38. 



Figure 38. - Integrator Realization of a. S3mchronizer 
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This type of synchronizer can be mechanized on a DDA using one 
integrator plus a means of performing the switching operation. The differen- 
tial equations describing the synchronizer are: 

^ _ 0 - X if not engaged, 
dt 0 if engaged 

• e = 6 - X 

These synchronization equations are readily implemented in a general- 
purpose computer. 

It is fairly simple to implement the limiter function on a general- 
purpose digital computer. Diode limiters are quite common on analog com- 
puters. Once again, through, DDAs are a different situation. It is necessary 
to resort to some special devices in order to implement this function on a 
DDA, A threshold (or level detector) device is required to prevent the output 
register incrementing (or decrementing) once another register has exceeded 
the threshold. Each limiter will probably require either an additional 
integrator or additional hardware, or both, depending upon thie method used to 
implement the threshold device. 

The deadband function has the same problems associated with it for 
DDA implementation as did the limiter. A threshold- sensing device capable 
of controlling the increimenting (or decrementing) of another device must be 
used. This aniounts to either additional hardware and/or at least one addi- 
tional integrator for each deadband fxinction. Deadbands are readily imple- 
mented in geiieral-piirpose computers. 

The fade-in/bleed- off function can be implemented on a DDA by using 
a switching device to control the input, and three integrators to product the 
lag. The switching device will require additional hardware under control of 
the engage circuitry. A block diagram of a DDA realization of this function 
is shown in Figure 39. These functions are readily implemented in general- 
pimpose computers. * • ‘ 
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dt 


di 


SWITCHING 

W 

DEVICE 



I - X 




(i - x)dt 




a(i - x) dt - dx 


OUTPUT^ 


Figure 39. - Fade-In/Bleed-Off DDA Realization 


. - , The hysteresis function has much the same problem with PDA imple- 

mentation as do other nonlinear functions^ Some additional hardware and/or 
integrators will.be required to provide the decision elements. This function 
can be implemented on an analog computer with positive feedback operational 
amplifiers and on general-purpose computers. 

Trigonometric and exponential functions can be implemented with ease 
on both general-purpose machines and on PDAs. The implementation of 
these functions on PDAs has been treated extensively in elementary treatises 
on. PDAs and is not repeated here. An exponential function can be imple- 
mented with one integrator, while a sine, cosine, or tangent function requires 
two integrators. 

Engage logic is a chore for both general-purpose and DDA computers. 
Neither machine is particularly suited to the task. It is cumbersome and 
tedious to handle engage logic on general^ purpose machines with standard 
instruction repertoires. DDAs are generally not capable of handling this 
sort of a problem. Those that are include a lot of additional special-purpose 
hardware, which, of course, indicates how engage logic must be handled on 


157 




a DDA, i. e. , by adding additional hardware. If the same additional hardware 
were added to a general-purpose machine type configuration or if logic- 

( 

oriented instructions are provided, a simpler engage logic structure would 
emerge. 

It is interesting to compare a DDA configuration with a GP approach. 
This can be done by utilizing previous results of a fairly detailed, DDA 
mechanization study for an arbitrary triple fly-by-wire system. Figure 40 
illustrates the arbitrary FEW system that was used in the study. The per- 
tinent data for a comparison has been reproduced from that study. 


Figure .40 indicates that the following functions per branch are 
required: 


Item 

First-order lags 
First-order/ second order 
Second order/ second order 
Gain Schedules 
.Median selects/fault detect 
Branch balancing 


Quantity 

6 

3 

3 

3 

8 

8 


The sizing rules that have been developed were used to translate these 
requirements into memory and computation time requirements for the GP 
computer and integrators, etc., for the DDA, The hardware for the two , 
mechanizations is summarized in Table 22. ‘ ' : ' 

The following observations can be made: 

• The GP machine is cheaper because it has fewer parts and fewer 
subassemblies. Both the parts cost arid the assembly labor will 
be less, 

• The GP machine is more reliable. Fewer parts imply lower MTBF, 
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MS - MEDIAN SELECT 

BB - BRANCH BALANCE 

CBM - CROSS BRANCH MONITOR 


Figure 40. - FBW Computer Block Diagram - Three Channels, One Branch 














• The GP machine requires 50 percent more power. 

• Both machines require about the same volume. The special purpose 

3 

required' 5 by 6 by 4. 25 in. (128 in ) arid the GP requires 6. 25 by ‘ 
'6. 25 by 3. 75 in. (146 in^). , 


TABLE 22. - COMPUTER HARDWARE REQUIREMENTS 


Hardware 

General-purpose 

Special-purpose 

LSI chips 

42 

32 

Hybrid chips- 

. 2 

45 > 

Bipolar T L chips 

134 

533 ^ 

Bipolar linear chips 

15 

- • 9sm' 

Discretes 

396 

334, •. 

Chassis parts: 



Capacitors 

10 

; 2 

• Transformers 

1 


Resistors 

10 


'• Stand mtg semiconductors 

28 


Other 


8 

Total nonchassis 

589 

953 

Total chassis 

49 

10 -- , 

PWBs 

8 

14 • 

Power (total, • watts) . 

34. 1 

23 : 


It must be notied.that the FBW configuration used in the above compari- 
son does not include any nonlinear functions. The ATT flight control system, 
on the. contrary, includes a large number .of nonlinear functions, and, conse- 
quently,. a DDA configuration would be at a niore severe disadvantage in 
comparison with a GP configuration. . 

It is estimated that 1978-80 general-purpose airborne computers will 
have speed sufficient that all input/output and processing operations can be 
updated at an adequate, rate (40 to 160 iterations per second) with an adequate 
margin for program. growth. This compares with the 20 to 100 ips rate of 
some current incremental computers. It should be noted that, although the 
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incremental machines are cycling faster than the proposed rate for the 
fp.rtticoming general-purpose machines, their effective bandwidth is less 
since the incremental computer is slew -rate -limited and thus requires two 
to five iterations to generate the equivalent of an V exact solution'! .following 
a transient input. 

... . ..... ,A significant advantage of a whole word pvpr an incremental computer 
relates to the wholeword machine's ability to perform logic decisions asso- 
ciated with AFCS mode control, redundancy management, interchannel and 
I/O communication, and BITE functions in software. The incremental 
machine, on the other hand, requires a considerable amoxmt of special- 
i pxirpose hardware for these purposes, which is difficult to modify once 
installed. 

It appears at this time that the incremental machine will continue to 
possess some advantage in the ease and facility of incorporating program 
modifications and changes; however software verification can be performed 
more comprehensively and with greater facility on a wholeword .machine. 

The inclusion of redundancy management decision making, as well as 
off-line and on-line BITE, in wholeword machine software makes it possible 
to consider a very high level of monitoring and BITE integrity. The incre- 
mental machine, however, is not fitted for this type of application. 

Possibly the most important influence on the tradeoff of incremental 
versus wholeword machines is the direction taken by the electronics industry. 
Industry is placing primary emphasis, including product development funding, 
on state-of-the-art advancement of wholeword general-purpose processors 
for a wide range of commercial applications. Accordingly, the use of special- 
purpose computers is receiving less consideration in forthcoming technology. 

These reasons were considered to be sufficiently compelling to eliminate 
the study effort necessary to define the unique computing modules necessary 
for a DDA-type processor as one of the ATT candidate FCS configurations. 
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MEMORY 


Core, plated wire and semiconductor memories comprise the chief 
hardware mechanizations available for digital flight control applications. | 
Table 23 compares the basic characteristics of these memories. Figure 41 

» \ *" *' C- 

shows normalized projected cost curves based on high-volume production. ; 

Magnetic memories (core and plated wire) provide convenient repro- 

j 

gramming, an essential characteristic during the system development, phase . 
or for applications which require frequent program changes. Once pasti.the 
development phase, flight control applications require changes infrequently. 
Indeed, a memory which cannot be altered as a result of transient improper 
processor operation is preferred. 

Due to the advantages of semiconductor memories, primarily low cost, 
they are preferred for production flight control systems. ■ Typically, semi- 
conductor memories employ read-only-memories (ROM) for instruction and 
constant data storage and read-write memories (RAM) for variable data. 

In ROMs, memory content is determined in the manufactiu*ing process and 
cannot be changed. . . 

Several semiconductor vendors manufacture programmable read- only- 
memories, (PROMs) which permit writing data permanently into the memory 
after mzinufacture. Read mainly memories (RMMs) which may be repro- 
grammed any time, are produced by several vendors, and under development 
by others. Typically, these memories are used as ROMs in actual processor 
operation; reprogramming is accomplished via special "write" hardware not 
included in the operational system. Packaging density smd manufacturing costs 
equivalent to current ROMs are anticipated for the PROM memories by 1978. 
Consequently, these memories were considered optimmn for the ATT flight 
control system configuration trade study. 
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TABLE 23. - MEMORY CHARACTERISTICS 


type 

' ‘-.of 

memory 

Type 

of 

construction 

Read/ 

write 

characteristics 

Physical 

characteristics 

Core 

.1 ■ 

Ferrite cores 
threaded with 
2, 3, or 4 
conductive wires 

Destructive readout; 
nonvolatile; 
reprogrammable; 
random access 

Higher weight 
and power 

Plated wire 

Thin film of mag- 
^ netic material 
over small con- 
X ductive wires 

Nondestructive read- 
out; nonvolatile; 
r eprogr ammable; 
random access 

Low power; 
faster than core 

Semiconductor 

Bipolar or MOS 
(metal oxide 
semiconductor) 

' semiconductor 
material 

Nondestructive read- 
out; nonvolatile 
(instructions and 
constants); program- 
mable (PROM); 
reprogrammable 
(RMM); random 
access 

Lightweight, 
low power 
faster than core 
or plated wire 
(access times of 
0. 5 /usee 
anticipated) 



Figure 41. - Memory Cost Comparison 
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SIGNAL FLOW TRANSMISSION 

j^i: 

The computer in a digital flight control system processes digital 
signals and issues digital commands. The signals are a measure of activity 
within the analog world. The commands, in turn, require spme response in 
the analog world. The discrete digital controller operates upon an alien 
environment. At some point in the process, a sensor information conversion 
from analog to digital data is required; likewise, a conversion from digital 
commands back to analog responses is required. 

The point of the foregoing discussion is that at present the DFCS has 
to interface with an all-analog world. The balance of the discussion will be 
concerned with means of gathering and delivering these analog signals to the 
computer within the DFCS in a compatible form. The inverse operation at 
the output must be considered also. There are basically two ways that this 
can be handled, 

• Each analog signal can have a dedicated, hardwired transmission 
line connecting the sensor or servo to the autopilot unit. This is 
the way analog autopilots are configured. This method is called, 
hardwiring. 

• Analog signals can be grouped or assembled at one or more remote 
locations and then sent to the autopilot unit along a common bus. 

This method is called multiplexing. 

Completely hardwired configurations have several drawbacks. Per- 
haps foremost is the large wire bundles that result. These bundles become 
almost unmanageable in cross- strapped redundant systems. In this type of 
system, every copy of every signal is connected to each channel of the re- 
dundant autopilot. A quadruplex system, for example, would as a base 
require a quantity of wires equal to four times the combined number of signal 
sources and servos. In addition to these, a number of supporting wires such 
as fault announcing, for detection logic interconnects, etc. , must be added. 
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Another drawback in use of hardwiring in redundant systems is the 
resulting multiple connectors required. Increased cost, increased space 
and decreased reliability are the primary concerns caused by additional 
connectors, and these are highly significant effects. 

in a highly sophisticated multiplexed configuration the quantity of 
wires can be reduced to one transmission bus per channel of the replicated 
system. This potential reduction in the quantity of aircraft wires is perhaps 
the chief reason for employing a multiplexed configuration. It must be noted, 
however, that multiplexed systems do use hardwiring techniques also, par- 
ticularly, at input and output interfaces. By judicious grouping of sensors 
and actuators, the impact of this hardwiring may be greatly reduced. 


Frequency Division Multiplexing (FDM) . 

In FDM systems, each signal to be processed is assigned a carrier 
frequency. This frequency is then modulated about its nominal or center 
value as a function of the amplitude of the analog signal being processed. 

This is often handled with a voltage controlled oscillator (VCO). When the 
analog signal is at its highest plus value, the VCO will be at its highest fre- 
quency. When the analog signal is at null, the VCO will be at its center 
value. Likewise, when the analog signal is at is maximum minus value, the 
VCO will be at its lowest value. The accuracy of this sort of an arrangement 
is highly dependent upon the linearity of the VCO and the accuracy of its 
nominal frequency. 

Each analog signal will have its own VCO with its own unique center 
frequency. There must be enough spread in the center frequencies to avoid 
all possibility of overlap. The outputs of these VCO's are combined into a 
mixer and ported onto a single transmission line. Band separation filters 
are used at the other end to recover the various carrier frequencies. Each 
carrier is then detected by some suitable means to extract the analog signal 
content. 
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Time Division Multiplexing (TDM) 


r. 


In TDM systems, each analog signal is assigned a time-slot and is 
transmitted as sampled data. A commutating device is then used to assign 
the bus to each of the analog signals during its time-slot. No two analog 
signals will ever have access to the bus simultaneously. This is in sharp 
contrast to FDM, where all signals are transmitted simultaneously and 
continuously. 

The options available to the FDM system designer are limited when 
compared to those of a TDM system designer. Once the decision to go FDM 
has been made, about all that remains to be decided are the frequency modu- 
lation technique to be used and the demodulation technique. This does not 
carry over to TDM, however. 

In TDM systems, one of the first decisions to be made is the type of 
modulation to be used. Some of the more common options are: 

• Amplitude Modulation, where the analog signal, or some constant 
times it, is simply connected to the transmission bus during that 
signal's time slot. 

• Pulse Width Modulation (PWM) . where the analog signal is "digitized" 
by encoding its value into the width or duration of a pulse of constant 
amplitude. When that particular signal's time slot comes up, a pulse 
of the correct "width" will be transmitted along the bus. 

• Pulse Code Modulation (PCM), where each analog signal is converted 
to a digital word of a suitable number of bits. When the appropriate 
time slot comes along, the digital coded word will be transmitted as 
a train of uniform pulses with some rule to distinguish "ones" from 

fl 
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zeroes. 
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Another decision to be made is the bus allocation of commutation 
strategy. There are basically two types: 

• Sequentially, where time slots are assigned according to some fixed, 
periodic algorithm. 

• Demand, where time slots are assigned on a demand or request basis. 
Some master device must create this demand. 

In the first case, all signals will be ported onto the bus and trans- 
mitted irrespective of whether they are required by the autopilot for the 
mode presently being controlled. In the latter case, the autopilot will limit 
its requests to the required signals only. 

Another decision to be made is the method of data identification. If 
sequential bus assignment is chosen, there are basically two methods of 
identification that can be used: 

• Time- slot, where the receiver computes the same bus allocation 
algorithm as the sender. Signals are identified by their time slot 
assignments. 

• Coded, where each different signal has its own unique identifying 
label that is transmitted along with the data. 

If demand bus assignment is chosen, the data identification is 
restricted to the latter since there is no algorithm to be duplicated. 

The type of transmission method, parallel or serial, must also be 
selected. In the parallel case, all bits that make up a multiplexer word are 
assigned their own individual transmission line and are transmitted simul- 
taneously. However, the analog signals would still be sampled and trans- 
mitted according to their time- slots. 



In the serial case,, all of the bits that make up a multiplexer word are 
transmitted consecutively on the same transmission line. In other words, 
the bits that go to make up a multiplexer word are assigned bit-time- slots 
within the time-slots corresponding to each of the various analog signals. 

This is accomplished by a device that shall be called a parallel-to-seriaj 
converter. The receiver at the other end must perform the inverse operation 
to reconstruct the multiplexer word, from the individual bits. This is accom- 
plished by a device that will be called a serial-to-parallel converter. 

It is obvious that the serial method requires considerably fewer 
wires.. The exact nunaber cannot be specified for a. general situation. This 
savings must be, paid for by adding the parallel-to- serial and serial-tp- 
parallel converters and the corresponding reduction in the amount of data 
that can be transmitted within the same time period. 

Optimum criteria for an airborne multiplexing configuration were 
established as a result of Air Force Contract F33615-69-C-1574, The . 
results of this study were reported in Document AFFDL-TR-70-80, dated- 
June 1970 and entitled "Research Into the, Definition and Demonstration of an 
Optimum Solid State Switching and Multiplexing System for Use in a Fly-by- 
Wire, Flight Control System, " by Mrazek, et al. The results of that study 
that are of interest here are as follow:s: 

^ . 1) . TDM should be used rather. than FDM 

2) PCM type of modulation should be used 

3) Data identification should be via a label rather than by time- 
slot. 

4) While the subject was, not specifically discussed, it may be 
deduced from the report that serial transmission is preferred 
to parallel. 
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■ " Global Versus Dedicated Busses 

' The above results establish some significant bench marks. At the 
same time, a major tradeoff consideration still remains. That is, should 
the multiplex bus be global or dedicated. Global, as the name suggests, 
means it covers the entire universe or airplane in this case. Dedicated 
means its use will be restricted to those devices to which it is dedicated. 

Flight control systems are not the only ones that stand to reap poten- 
tial benefits from multiplexed configurations. For example, some other 
systems that could also profit are the navigation system, the flight director 
system, etc. If all of these systems are combined onto a conimon multiplex 
bus with all units accessible by all other units, a global bus would result. If> 
on the other hand, items peculiar to the navigation system are the only ones 
that are on a particular bus, then it would be called a dedicated bus. The 
flight director system could have its own dedicated bus as well as the flight 
control system or the navigation system. The decision as to which is best, 
global or dedicated, is beyond the scope of this effort. However, some factors 
that would impact that decision are outlined below. 

Dedicated busses can be operated either sequentially or on a demand 
basis. Global busses usually have a special device which acts as a master 
traffic controller, The traffic controller would, no doubt, operate in some 
sequential fashion but would require the other devices to essentially respond 
on demand. 

Global busses are more prone to time saturation than are dedicated 
busses. A given bus design has a certain channel capacity or the ability to 
handle a certain number of transactions in the available time. Global busses 
have more transactions to handle than dedicated busses. Furthermore, the 
larger number of variables require longer labels to provide unique identifi- 
cation. For example, 8 variables require 3 bits while 16 variables require 
4 bits. Global busses then not only have more, but also longer words to 
handle than do dedicated busses and will be more prone to exceed the channel 
capacity. 
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Global busses have more terminals or ports and hence more oppor- 
tunity for line jamming or other catastrophic failures. If the navigation 
system had its own dedicated bus, it would not be possible for a failure in, 
say, the navigation system to migrate or propagate into the flight control 
system. The same level of assurance would be more difficult to obtain in 
a global configuration. 

Each bus, whether it is global or dedicated, requires a traffic con- 
troller. The total amount of electronics would likely be less if a global'bus 
were used than it would if the global structure were to be partioned into ' 
several dedicated structures. There certainly would be a savings in the 
traffic controller hardware. 

A number of the alternate methods of signal flow transmission were 
considered in the various candidate configurations. For instance, configu- 
ration 1 is a completely hardwired system whereas configuration 3 is a fully 
multiplexed arrangement. Other configurations use data bus techniques only 
for intercommunication between processors. Where the signal transmission 
method was assumed to have a significant effect on the tradeoff, the configur 
ration description in Section 7 includes some discussion of the pertinent - 
features. 



SECTION 7 

CANDIDATE CONFIGURATIONS 


, Section .5 described many of the tradeoffs considered involving different 
sensor, computation, actuator, redundancy, crossfeed and data transmission 
alternatives. Obviously, consideration of all of the possible combinations 
and permutations of even the remaining (and most likely) alternatives would 
have been an impossible task. Consequently, 24 configurations were defined 
by applying the results of the component tradeoffs in the most probable com* 
binations. The relationship of these candidate configurations may be seen in 
Figure 42, the candidate configuration tree. 

. It is the main purpose of this section to briefly describe each con- 
figuration which was ultimately input to the life-cycle cost computations and 
subject to the tradeoffs for selection of the optiinum configuration. The 
numbers included in the lower tier of blocks on Figure 42 denote the designa- 
tion for the specific configuration defined by following the branches from the 
top of the diagram downward. This system designatidh number will be used 
consistently throughout the remainder of the report. 

The redundancy and crossfeed concepts applied are primary charac- 
teristics in the description of each configuration. The same two factors, 
together with component failure rates, primarily define the operational 
reliability of each configuration. It is convenient and rational, therefore, 
to also include the operational reliability in the capsule configuration defini- 
tions contained in this section. 


OPERATIONAL RELIABILITY 

A determination of operational reliability, including a success path 
diagram, was prepared for each candidate configuration. The rationade used 
in performing these calculations is provided in the following paragraphs. 
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System Reliability 


System reliability was computed in terms of the system probability of 
failure for each of the system configurations proposed. This allows a direct 
comparison of each configuration's reliability against the reliability goal of 

-7 

1x10 failures per flight hour. For the purposes of this study, an operating 
time of eight hours was used in the reliability calculations to represent the 
approximate operating time of a commercial aircraft between stations with 
repair capability. 

Reliability success path block diagrams were drawn for each of the 
systems studied, where each block represents a major flight control function. 
The diagrams depict the level of redundancy, if any, employed for each 
function and note the necessary number of channels that must operate for 
system success, depending on the t 3 rpe of redundancy monitoring employed. 

Failure rates in percent per 1000 hours were assigned to each block 
as determined by the GEMM program employed in this study. These failure 
rates were derived from Honeywell standard piece part failure rates and 
commercial airline operational data. 

A probability of failure was calculated for each redundant function 
configuration based on the binomial expansion formCila of (R+Q)^ which 
assumes an exponential failure distribution where R=e and Q=l-R. A 
total system probability of failure (Q) was then determined by summing the 
subsequent series strings of failure probabilities. This could be done be- 
cause, for small probabilities of failures, Q^Xt. Therefore, ~ 

(X 1 +X 2 +X 3 + Xn)t or, in this case, Q-pQ^^^L “ ^jt+X 2 t+\ 3 t+ Xnt. 

The advantage of this approach to reliability prediction, where small 
failure probabilities are encountered, is that the reliability of a system is 
based on the summation of what are essentially failure rates rather than the 
product of a series of ten or more 9's behind the decimal point. Also, the 
relative contribution of each function to the system reliability can readily be 
seen-when expressed-in terms*-of negative powers of ten (Q). 
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The probability of failure per flight hour over the eight -hour period was 
calculated as 1/8 of the system probability of failure for eight hours. 

Assumptions and Approximations 

Assumptions . - Assumptions used in the reliability calculations were: 

• All channels are failure free and fully operational at dispatch 
(i, e. , perfect preflight and/or inflight testing). 

• Perfect failure monitoring and channel switching is provided by 
the failure monitors. 

• System probability of loss of system function, denotes flight’ safety 
and does not consider the effects of flights which may be aborted 
if one or more redundant channels become nonoperational i during 
the eight -hour day. 

• Redundant channels are truly redundant in the sense that there 
are no significant single elements that will compromise the 
calculated reliability of a redundant configuration. Examples 
are: common electrical power and hydraulic sources, a single 
control surface, a single electronic component failure that will 
cause a monitor to trip, etc. 

• All functions and flight axes are equally critical to flight safety. 
No reliability emphasis was placed on particular control axis or 
function being more critical than any other axis or function. 

Approximations. - Approximations employed in the reliability analysis 

were: 

• The failure rates of the three control panels were divided between 
each computer channel to reflect potential control panel failure 
contributions to each channel. 
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• Intercom, input /output, and data bus systems were similarly 
configured in the success path diagrams as representing a method 
of interconnecting redundant channels. The failure rate assigned 
to the circuitry of this fimction, in each case, was equally divided 
between that channel's sensor elements and actuator elements to 
approximate the effect of losing an entire chcinnel should a fail- 
ure of this function occur. 

• In each case, the portion of the digital computer that provided 
the intercom, input /output, or data bus functions was estimated 
as having one-third of the total computer failure rate. The re- 
maining two-thirds of the total failure rate was assigned to the 
computational functions. 

Satisfaction of Requirements 

Five configurations, 1, 2, 12, 16 and 19, were found to be clearly 

■ 7 . 

below the 1x10 flight hours per function loss requirement and were ruled out 
of serious consideration. Three other configurations, 4, 7 and 7A, were, 
slightly less than the requirement but would not be eliminated from considera- 
tion by this deviation alone. 


CONFIGURATION DESCRIPTIONS 


The 24 flight control configurations selected as trade study candidates 
are described in this subsection. Block diagrams, success path diagrams 
and other illustrations are included where pertinent. 

Configuration 1 

The initial and baseline configuration mechanized for this study is an 
analog primary flight control system (Figure 43) which provides the functions 
listed and described in Section 4. The flight critical fly-by-wire functions 
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(Class A) are performed in four identical comparison-monitored channels 
which provide a two-fail-operational capability. The autolanding (Class B) 
and outer-loop modes (Class C) are mechanized in a dual-dual arrangement. 

Quadruple sets of conventional, body rate, body acceleration, wingtip 
rate, wingtip acceleration and command sensors are fed into each quad com- 
putation channel where an optimum signal select is performed on each signal 
type to assure similar inputs to each computation channel. Downstream of the 
anailog control law computation, a comparison of the four-channel output com- 
mand signals is performed to detect faults, and the selected commands are 
crossfed to the appropriate servo amplifiers. 

Each of the 13 control surfaces is driven by a driver-power actuator 
set as shown in Figure .44. The four-channel driver assembly is force-summed, 
using pressure feedback for equalizing and monitoring. The driver assembly 
is mechanically linked to three power actuators. These surface actuators are 
either three separate^ side-by-side cylinders or a simple triple-tandem power 
actuator with the drivers integrally mounted, depending on the surface size 
and configuration. The triple-tandem actuator configuration used on small 
surfaces must provide the required hinge moment and yet be of a size and 
weight within the capability of maintenance personnel. Maintenance time 
studies are based on the use of modular construction, particularly in the 
driver. 

Primary hydraulic power is supplied by three dual-pump supplies (two 
pumps on each of the three engines)^ and a fourth supply is used, only for the 
fourth channel of the driver actuators. The driver actuators require only a 
very low- power, low-volume supply; it may be a separate "standby" supply 
which is electrically or shuttle-valve powered. 

The operational reliability for configuration 1 was determined with the 

aid of the success path diagram of Figure 45. A probability of loss of FCC 
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function of 1. 7 x 10 per flight hour over an eight-hour flight period was 
established for configuration 1. This is not within the specified requirement. 
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Figure 44. - Configuration 1 Control Surface Actuators - Ctoad-Driver 
and Triple-Surface (91 cylinders) 
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Figure 45. - Configuration 1 Success Path Diagram 







Configuration 2 


Configuration 2 is a hybrid configuration, included because it repre- 
sents an intermediate between full analog and full digital mechanization of the 
flight control system. It provides a triple- channel implementation of the FCS 
with a two-channel analog implementation of only the flight-critical functions 
as shown in Figure 46. 

The two analog channels are intended primarily as backup for the 
flight -critical functions 2 ind are on standby except in the event of a Second 
digital channel failure. 

In the digital portion of the mechanization, quadruple sets of conven- 
tional body rate, body acceleration, wingtip rate, wingtip acceleration and 
command sensor signals are crossfed in analog form into the triple-medium 
processor computation channels. A signal select is performed on each signal 
type to assure similar inputs to each channel. Autolanding and enroute mode 
computations are performed in each processor. Ftill processor outptrt cross- 
feed is provided in analog form. 

• The use of anzilog crossfeeds, comparison monitoring and less exten- 
sive self-test in the triple-redundant configuration permits accommodation 
with medium processors. The computational operations are essentially iden- 
tical to those in configuration 6, described later. 

■ A three-channel integrated actuator arrangement as shown in Figure 47 
is used. For a three-engine vehicle, this combination is undoubtedly the 
simplest arrangement. Integrated actuators are variations of two forms: 
three single integrated units in parallel on a surface, or a triple-tandem 
assembly of three integrated single -actuator sections. This latter configura- 
tion is most advantageous on smaller surfaces where a tandem design does not 
become unmanageable in maintenance because of its size. 

The integrated actuators operate in the active /on-line mode using in- 
line monitoring techniques. Hydraulic power is supplied from three dual-pump 


180 



■li 



Figure 46. - Configuration 2 Functional Redundancy Block Diagram 

(typical Class A functions) 
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supplies in a straightforward arrangement; no additional supplies are needed 
for "monitoring" channels. The flow capacity of each supply, however, must 
be adequate for full control. 

The operational reliability or probability of loss of the FCS function 

-7 

was established to be equal to 1. 95 x 10 per flight hour over an eight-hour 
period using the success path diagram shown in Figure 48. This value is not 
within the specified range. 

? Configuration 3 

Configuration 3 was selected and designed to be representative of the 
Air Force Digital Avionics Integrated System (DAIS) concept. Since DAIS is 
currently in the system architecture development stage, configuration 3 repre- 
sents one possible implementation of DAIS. One exception has been taken to 
the DAIS groundrules; namely, the multiplex terminal units (MTUs) do not 
include 32-word storage as required by the preliminary Air Force bussing 
standard. 

The basic redundancy of the flight -critical functions in configuration 3 
is shown in Figure 49. This configuration uses quadruple conventional sensors 
and command pickoffs. 

One channel of the quad configuration employing large processors, 
bidirectional data buses, and comparison monitoring is shown in Figure 50. 

As shown, the data bus connects the elements ^f the flight control 
system. Remote terminals are situated at strategic locations to minimize 
the number of terminals, A/D-D/A converters, etc. For ATT, these loca- 
tions were established by the physical proximity of sensors. For example, 
the controls -group sensors are all located in the flight deck area, permitting 
relatively short-run cabling between the actual sensor and the remote ter- 
minal which services it. The remaining remote terminals are as indicated. 
Crossfeed is accomplished by crossfeeding the data buses at the input to 
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Figure 49. - Configuration 3 Functional Redundancy Block Diagram 
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Figure 50. - Configuration 3 Digital Corriputation 
(one of four channels) 
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the computer LRUs, Processor I/O is accomplished via the bus control/ 
interface unit (BCIU). Each BCIU provides the capability to control only one 
bus while "listening" to all buses, thereby effecting the desired sensor cross- 
feed, Sensor selection is accomplished via software in each processor. Pro- 
cessor outputs are also intercommunicated via the busses, permitting each 
processor to perform comparison monitoring of all processor outputs. The 
majority :opini on of the processors is used to effect channel disengagement by 
the actuators, 

A block digram of the MTU is shown in Figure 51, As mentioned 
previously, with the exception of the 3 2- word buffer storage, this design is 
compatible with the preliminary Air Force bussing standard. The MTU 
serves as a standard bus interface device. Subsystems, such as the sensors, 
interface with the MTU via subsystem interface units (SSIU), A SSIU designed 
to handle analog inputs and outputs is shown in Figure 52. In this SSIU, all 
analog inputs and outputs are updated at a fixed rate in a fixed sequence inde- 
pendent of bus controller demands. Digital values representing each input 
are stored in the appropriate location in the 3 2- word RAM. When the MTU 
indicates receipt of a bus request, the specified RAM location is "read” and 
made available to the MTU for transmission on the bus. Similarly, when the. 
MTU receives a datum word on the bus, the word is presented to the SSIU for 
storage in the RAM, The SSIU then converts the word to analc^ form, updat- 
ing the sample and hold output circuit at the next time slot assigned that 
particular RAM location. 

The bus control interface unit (BCIU) is diagrammed in Figure 53. As 
indicated, the BCIU provides control over one bus by the associated processor 
while listening to all buses. Control is provided directly under program con- 
trol via the processor direct I/O (DIO) port. "Listening" is accomplished 
via the DMA port without interrupting the program. 

In the DAIS concept, only flight- critical functions are to be performed 
in the quad -redundant flight control processors. Non-flight-critical functions 
are to be performed in dual-redundant avionics processors, necessitating a 
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Figure 51. - Configuration 3 Multiplex Terminal Unit (MTU) 
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Figure 53. - Configuration 3 Bus Control Interface Unit (BCIU) 
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dual-to-quad bus interface. Such partitioning is also used in this configuration. 
A dual-to-quad bus interface is diagrammed in Figure 54. A "large" pro- 
cessor, loaded approximately 46 percent, is used in this configuration, some- 
what larger than in the configuration 9 crossfed system due to the additional 
bus control functions. 

Configuration 3 utilizes the same actuator arrangement as configura- 
tion 6. 


The operational reliability of configuration 3 was determined with the 
aid of the success path diagram of Figure 55. A probability of loss of FCS 

-7 

function equal to 0.37 x 10 per flight hour over an eight-hour period was 
established. 

Configuration 4 

The efficiencies possible with an integrated flight management system 
in which common sensors provide necessary inputs for both the flight control 
and inertial navigation have been widely heralded. The possibility of utilizing 
a single digital computer as the computational element for both functions has 
also been proposed for many applications. The possibilities inherent within 
such an arrangement were deemed of sufficient interest to justify implement- 
ing this concept as one candidate configuration. 

Mechanization of this configuration in a manner which would allow a 
meaningful tradeoff was found to be considerably more troublesome than was 
first apparent. The basic redundancy of a fly-by-wire flight control system 
appears not to be completely in accord with that necessary for an inertial 
navigation system. Quadruple redundancy inherent in the hexad sensor group 
is applicable for both functions, but, when considered for computation chan- 
nels, an excessive redundancy level for inertial navigation purposes appears. 
The cost of inertial-quality sensors is considerably greater than the cost of 
control-quality sensors, and, consequently, adjustments were required to 
permit comparison with the other candidates. The following ground rules were 
adopted for this mechanization. 
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Figure 54. - Configuration 3 Dual-to-Quad Bus Interface 
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Figure 55, - Configuration 3 Success Path Diagram 









• Computational capacity for the INS was not included. 

• Costs for six body accelerometers of a control quality were used. 

• Cost of the inertial- quality body gyros was based upon 50 percent of 

the actual estimated cost. ^Assuming 50% shared by INS) 

The computation portion of this configuration is based on quadruple 
large processors with anal(^ crossfed inputs and comparison monitoring as 
was used in configurations 6 and 7. . 

The actuator drive signals are crossfed to a triple-integrated actuator 
set on each control surface. This actuator set is the same as used in con- 
figuration 2. 

The operational reliability of configuration 4 was determined with the 

aid of the success path diagram of Figure 56. A probability of loss of FCS 

-7 

function equal to 1. 07 x 10 per flight hour over an eight-hour period was 
established. 

Configuration 5 

Configuration 5 consists basically of quadruple-isolated computational 
channels using large central processors as shown in the functionail redun- 
dancy block diagram for the flight-critical functions. Figure 57. 

A single sensor and command signal set is inputted without crossfeed 
to each large processor. One of the four channels is shown in Figure 58. 

Where incompatible interfaces exist, as for the triple and dual sensor 
groups, all sensor channels are provided to each processor channel. This 
assures that a single fault in a dual sensor set will not result in two flight- 
critical processor channels tracking together with different outputs with re- 
spect to the other two processor channels. This configuration uses the large 
processor loaded approximately 52 percent. As indicated, servo amplifiers 
providing analog servoloop closure and a power supply are included in the 
computer LRU. 
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Figure 56, - Configuration 4 Success Path Diagram 
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Figure 57. - Configuration 5 Functional Redundancy Block Diagram 
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Figure 58. - Configuration 5 Digital Computation (one of four channels) 
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A detailed block diagram of the configuration is shovm in Figure 59. 

I/O functions are generally performed under program control. For analog 
inputs, the processor I/O command specifies the required signal and initiates 
the A/D conversion. The processor extracts the digital value representing 
the selected signal when the conversion is complete. For analog outputs, the 
processor output command specifies the desired output sample and hold cir- 
cuit and initiates D/A conversion of the output value. Discrete inputs and 
oiitputs are processed as individual bits packed in words. Serial digital out- 
puts are converted from parallel to serial form and then gated out through 
thie serial output bus specified by the processor output command. Since the 
air data and panel digital inputs are received asynchronously with respect to 
the processor, they are stored in memory through the DMA, port when 
received. 

Each serial bus terminates in a receiver and a word assembly register. 
Labels, included with the words, are used by the DMA control logic along 
with the receiving channel designation to specify the proper memory address 
for each newly received word. The power supply provides regulated voltages, 
sensor excitation, etc. , to all elements of its channel. Since in-line monitor- 
ing is used, extensive self-test (BITE) features have been incorporated. Dual 
input paths are provided for analog signals, enabling detection of input path 
failures by the processor. Discrete input paths are. stimulated, under pro- 
cessor control, to both "1" and "0" states to detect failures. Outputs are 
"wrapped around" ^or comparison of "intended" versus "actual" output values 
by the processor, thereby testing both the output and input path used to effect 
"wraparound". Processor loading and memory estimates reflect the additional 
computations necessary to accomplish self-test. 

Landing and enroute mode computations are performed by the isolated 
and inline monitored computational channels in the same manner as the flight- 
critical functions. 

The hydraulic supply and actuator configuration used is identical to 
that utilized by configuration 1. 
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Figure 59. - Configuration 5 Detailed Block Diagram (one of four channels) 
























The operational reliability or probability of loss of the FCS function 

-7 

was established to be . 05 x 10 per flight hour over an eight-hour period 
using the success path diagram shown in Figure 60. 

Configuration 6 

The basic redundancy of the flight-critical functions in configuration 6 
is shown in the block diagram of Figure 61. This configuration uses quad- 
ruple conventional sensors and commands. 

One channel of the quad configuration using the large processor, analog 
crossfeeding and comparison monitoring is shown in Figure 62. As indicated, 
a full crossfeed for all sensor signals is provided at the input to the com- 
puter LRU. Additionally, a full processor output crossfeed is included in 
analog form. Dedicated signal selectors and comparison monitors are in- 
cluded in each computer LRU. I/O differs from configuration 1 in that more 
input paths are required to effect sensor crossfeed and that less extensive 
self-test is provided. A detailed block diagram is provided in Figure 63. A 
large processor, loaded approximately 56 percent, is used. 

Landing and enroute mode computations are performed in a dual-dual 
comparison monitored arrangement. 

Each of the 13 control surfaces is driven by a quadruple integrated 
actuator set. These surface actuators are either of two basic potential 
mechanizations — two dual-tandem integrated actuators or four single- , 
channel integrated actuators. : 

Operation of all four actuation channels is a version of the active /on- 
line mode; the pressure feedbacks are so shaped that full hinge-moment 
power is available from two channels when needed. 

Hydraulic power supply becomes a problem; four full-capacity 
supplies are required, although the size of each would be somewhat less than 
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Figure 62. - Configuration 6 Digital Computation (one of four channels) 
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Figure 63. - Configuration 6 Detailed Block Diagram (one of four channels) 






















systems using three sources. The fourth supply is most readily provided by 
pumps driven by redundant electric motors. 

The operational reliability for configuration 6 was determined with the 
aid of the success path diagram of Figure 64. A probability of loss of the 

_7 

FCS function of 0, 85 x 10 per flight over an eight-hour flight period was 
established. 


Configuration 7 

Configuration 7 uses quadruple conventional sensors analog crossfed 
to large processors. The sensor and computational sections are identical to 
configuration 6. The description is, therefore, also applicable to this con- 
figuration. 

In this case, the actuator drive signals are crossfed to a triple inte- 
grated actuator set on each control surface. This actuator set is the same as 
was used in configuration 2. 

The operational reliability for configuration 7 was determined with the 

aid of the success path diagram of Figure 65. A probability of loss of FCS 

-7 

function of 1.08 x 10 per flight hour over an eight-hour flight period was 
established. 


Configuration 7A 

Based on configuration 7, configuration 7A replaces the conventional 
gyros in each location with a laser gyro. This was done primarily as a 
reference point for cost comparison, since the item used is a higher-priced, 
navigation-grade sensor with performance characteristics beyond that neces- 
sary for body rate and flutter sensing. 
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Figure 65. - Configuration 7 Success Path Diagram 
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The probability of loss of FCS function for this configuration is essen- 
tially the same as for configuration 7. 

Configuration 8 

The basic redundancy of the flight -critical function in configuration 8 
is shown in Figure 66. This configuration uses quadruple conventional sen- 
sors and command pickoffs. 

A primary feature of the configuration is the autonomous I/O cross- 
feed by independent small processors. Quadruple medium processors per- 
form the control computation. 

One channel of the small I/O processor unit (lOPU) and a medium con- 
trol computation processor unit (CCPU) interface is shown in Figure 67. 
Crossfeed is provided at the lOPU/CCPU interface via bidirectional buses. 
Comparison monitoring is employed for failure detection; each CCPU com- 
pares the signals transmitted from the four different lOPUs, and each lOPU 
compares signals received from the four different CCPUs. For a more 
detailed description, see Section 10, "Selected Svstem Description". 

The operational reliability or probability of loss of FCS function was 

-7 

established to be 0. 16 x 10 per flight hour over an eight-hour period using 
the success path diagram shown in Figure 68. 

Configuration 9 

The basic redundancy of the flight -critical functions in configuration 9 
is shown in the block diagram of Figure 69. This configuration uses quad- 
ruple conventional sensors and command pickoffs. 

One channel of the quad configuration using large processors, pro- 
cessor-to-processor intercommunication for crossfeed, and comparison 
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Figure 66. - Configuration 8 Functional Redundancy Block Diagram 
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Figure 68. - Configuration 8 Success Path Diagram 
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Figure 69. - Configuration 9 Functional Redundancy Block Diagram 






monitoring is shown in Figure 70. With the exception of the triple-redundant 
attitude signals, sensors are provided only to the computer LRU in the same 
channel; i. e. , sensor crossfeed is not provided at the input to the computer 
LRU. However, crossfeed is provided via intercommunication between pro- 
cessors. This form of crossfeed has been termed ’’pseudo crossfeed” in 
that, given all processors operating properly, full sensor crossfeed is pro- 
vided. However, in the event of a processor failure, the sensors in the 
failed processor channel are no longer inputted, A detailed block diagram of 
configuration 9 is provided in Figure 71. With the exception of slight differ- 
ences in the number of input paths, addition of the intercommunication paths, 
and self-test features, the I/O is like that of configuration 5. A large pro- 
cessor, loaded approximately 44 percent is used. 

All autoland and enroute mode computations are performed in quad- 
ruple. 


This configuration uses the same actuator arrangement as configura- 
tion 6. 


The operational reliability or probability of loss of FCS function was 

-7- 

established to be 0. 26 x 10 per flight hour over an eight-hour period using 
the success path diagram shown in Figure 72. 


Configuration 9A 

Configuration 9A is identical to configuration 9, except, like 7A, 
replaces all conventional gyros with laser gyros. 


Configuration 10 

Configuration 10 utilizes quadruple conventional sensors with each set 
inputted independently to a large processor. Pseudo crossfeed is provided by 
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Figure 72. - ConfiguraLtion 9 Success Path Diagram 







intercommunication between processors. The sensor and computational 
sections are identical to configuration 9. 

The actuator drive signals are supplied to a quad driver-triple power 
actuator set on each control surface. This actuator set is the same as used 
in configuration 1. 

The operational reliability for configuration 10 was determined with 

1 Ji • 

the aid of the success path diagram of Figure 73. A probability of loss of 
FCS function of 0.26 x 10 per flight hour over an eight -hour flight period 
was established. V 


Configuration 11 

Configuration 11 is another variation of the basic configuration 9. A 
set of six magnetohydrodynamic (MHD) gyros is used to replace the body rate 
sensors. Since the MHD gyro is a two-axis device, six gyros mounted in 
two three-gyro orthogonal sets provide the same information as twelve con- 
ventional gyros in four three-gyro orthogonal sets. Single-axis conventional 
gyros are used in the wingtip location because (1) there is no requirement for 
a two-axis device in this application, and (2) this location is subject to ex- 
treme environmental conditions and vibration modes. 

Quadruple conventional accelerometer and command pickoff signals 
provide isolated inputs to the large processor channels. Pseudo crossfeed is 
provided by intercommunication between processors. The computational 
section and actuator set are identical to configuration 9. 

The operational reliability of configuration 11 was determined with the 

aid of the success path diagram of Figure 74. A probability of loss of FCS 

-7 

function of 0. 25 x 10 per flight hour over an eight-hour period was 
established. 
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Figure 73. - Configuration 10 Success Path Diagram 
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Figure 74. - Configuration 11 Success Path Diagram 











Configuration 12 


The basic redundancy of the flight -critical functions in configuration 
12 is shown in Figure 75. This is a triple-redundant inline monitored con- 
figuration without crossfeed in which each channel is essentially identical to 
the individual channels of configuration 5. Triple-redundant conventional 
sensors and command pickoffs are used. 

One of the three computational channels is shown in Figure 76. A 
large processor, loaded approximately 52 percent is used. Since the single- 
channel electronics are nearly identical to those of configuration 5, no addi- 
tional block diagrams are included. All autolanding and. enroute mode com- 
putations are performed in triplicate. 

This configuration drives the control surfaces through the minimum 
acceptable actuator set (Figure 77). This actuator set uses triple-integrated 
actuators to drive the horizontal stabilizer, upper rudder, lower rudder, 
wingtip flutter control surface and the outboard trailing edge flutter suppre- 
ssion. Dual-tandem integrated actuators are used to drive the midspan 
ailerons, tip spoilers and midspan spoilers. Dual-redundant actuators are 
adequate for these surfaces because they are all basically used for roll con- 
trol, and it was determined by General Dynamics that operation of any two 
out of the three surfaces sets will allow retention of safe aircraft control. 

The operational reliability or probability of loss of FCS function was 

- 7 

established to be 1.47 x 10 per flight hour over an eight-hour period using 
the success path diagram shown in Figure 78. This value is not within the 
specified range. 


Configuration 13 

Figure 79 shows the basic redundancy of the flight -critical functions 
of configuration 13. This configuration uses quadruple conventional sensors. 
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Figure 75. - Configuration 12 Functional Redundancy Block Diagram 
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Figure 76. - Configuration 12 Digital Computation 
(one of four channels) 
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Figure 77. - Configuration 12 Control Surface Actuators - Minimum Acceptable Set 
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Figure 78. - Configuration 12 Success Path Diagram o 
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Figure 79. - Configuration 13 Functional Redundancy Block Diagram 
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a small-processor I/O section, a medium-processor control computation 
section and a triple-integrated actuator set. 

The sensor and computational sections are identical to configuration 8. 
The description of these sections is applicable, and the more detailed des- 
cription in Section 10, "Selected System Description" also provides additional 
definition. A triple-int^rated actuator set identical to that used in configur- 
ation 2 operates, each of the 13 control surfaces. 

The operational reliability of configuration 13 was determined with 

the aid of the success path diagram shown in Figure 80. A probability of loss 

-7 

of FCS function of 0.62 x 10 per flight hour over an eight-hour period was 
established. 


Configuration 13A 

The quadruple redundant orthogonal sets of body rate and acceleration 
Sensors are replaced by a single hexad body rate eind acceleration group in 
this variation of configuration 13. A complete description is given in 
Section 10, "Selected System Description". 


Configuration 14 

The basic redundancy of the flight -critical functions in configuration 14 
is shown in Figure 81. This is a triple-redundant in-line monitored large 
processor configuration with pseudo crossfeed via processor intercommunica- 
tion. Triple-redundant conventional sensors and command pickoffs are used. 

One of the three computational channels is shown in Figure 82. Since 
in-line monitoring is used, extensive self-test features are incorporated as 
in configurations 5 and 12. A detailed block diagram is provided in Figtire 83. 
The large processor in each chaimel is loaded 66 percent, reflecting inclusion 
of both self-test and three-channel signal selection computations. 
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Figure 81. - Configuration 14 .^notional Redundancy Block Diagram 
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Figure 82. - Configuration 14 Digital Computation (one of three channels) 
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Figure 83. - Configuration 14 Detailed Block Diagram (One of three channels) 























The actuator arrangement used is the same as for configuration 
number 12. 

The operational reliability or probability of loss of the FCS function 

-7 

was established to be 0. 05 x 10 per flight hour over an eight -hour period 
usir^ the success path diagram shown in Figure 84. 

Configuration 14A 

This system is based on configuration 14, and replaces all gyros 
with MHD gyro configurations. Again, this was done to provide a cost data 
point. The MHD gyro provides two-axis sensing in a single package, thus 
reducing the total number of system components. This is a prime factor in 
reducing total life-cycle cost. 


Configuration 15 

Configuration 15 presents a minor actuator modification to configura- 
tion 14. Consequently, the sensor and computational description for configura- 
tion 14 is fully applicable for this case. 

This is a triple-redundant in-line monitored large processor configura- 
tion with intercom crossfeed. A triple-integrated actuator set for each con- 
trol surface is an obviously consistent and ideally matched arrangement for 
the tri-jet aircraft. A description of the triple integrated actuator is included 
as part of the configuration 2 discussion. 

The operational reliability or probability of loss of FCS function was 

-7 

established to be 0. 5 x 10 per flight hour over an eight -hour period using 
the success path diagram shown in Figure 85. 
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Figure 84. - Configuration 14 Success Path Diagram 
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Configuration 16 


Configuratimi 16 is another variation of the basic concept presented 
with configuration 14, In this case, the sensor configuration is modified, 
but the computation and actuator description included for configuration 14 is 
pertinent. 

The high initial cost of body rate sensors in redundant orthogonal sets 
is an obvious area for cost improvement. The use of skewed sensor sets to 
reduce the total number of sensors is an attractive possibility. This con- 
figuration was mechanized as a pentad of in-line monitored conventional gyros, 
thus saving four gyros per system in comparison with a nominal triple- ortho- 
gonal set using nine gyros. Section 6 considers a number of the aspects of 
skewed sensor arrays. The accuracy improvement possible through averag- 
ing techniques is another advantage of such a configuration. 

The operational reliability or probability of loss of FCS function was 

-7 

established to be 9. 2 x 10 per flight hour over an eight-hour period using 
the success path diagram shown in Figure 86. This value is not within the 
specified range. 


Configuration 17 

Configuration 17 is another variation of the basic concept presented 
with configurations 4, 6 and 7, In this case, a different control surface 
actuator arrangement is considered. The sensor and computation description 
included in the configuration 6 discussion is applicable. 

This configuration uses quadruple conventional sensors analog cross- 
fed to large processors. Mechanization with a four-driver- actuator /three- 
power-actuator arrangement on each control surface is fully consistent with 
the three-engine aircraft. Such an actuator mechanization was incorporated 
in configuration 1. It should be noted that this arrangement does provide an 
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Figure 86, - Configuration 16 Success Path Diagram 







additional analog crossfeed at the driver actuator summing linkage to the 
power actuators. 

The operational reliability for configuration 17 was determined with 
the aid of the success path diagram of Figure 87. A probability of loss of 

>7 

FCS function of 0. 8 x 10 per flight hour over an eight-hour flight period 
was established. 


Configuration 18 

This dual /triple- channel configuration is shown in Figure, 88. 

Triple-redundant conventional sensors and command pick offs are used. 
Flight-critical functions are performed in the triple- channel medium^size 
processors. Non-flight-critical functions are performed in the dual-channel 
medium-size processors. Each processor controls its own I/O functions as 
well as performing the required flight control computations. Sensor signal 
crossfeed is accomplished via the pseudo crossfeed technique with processor 
intercommunication paths. 

Inline monitoring is used for both flight-critical and non-flight- 
critical functions. A detailed block diagram of the flight-critical processor 
and I/O is provided in Figure 89. Operation is generally similar to other 
configurations. Unidirectional buses are included to provide transmission of 
signals from the non-flight-critical processors. Since inline monitoring is 
employed, extensive self-test features are included. A medium processor, 

98 percent loaded, is used for the flight-critical computations. 

A detailed block diagram of the non-flight-critical processors and 
I/O is provided in Figure 90. Overall operation is similar to other configura- 
tions. Since inline monitoring is used, extensive self-test features are 
included. A medium processor loaded 66 percent is used for the non-flight- 
critical computations. 
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Figure 88. - Configuration 18 Digital Computation 
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Figure 90. - Configuration 1;8 Detailed Block Diagram Non- Flight- Critical 
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The actuator arrangement used is the same as configuration number 

12. 

The operational reliability or probability of loss of FCS function was 

-7 

established to be 0. 13 x 10 per flight hour over an eight-hour period using 
the success path diagram shown in Figure 91. 

Configuration 19 

This configuration consists basically of triple- isolated computational 
channels using large central processors fed by conventional sensors. It is 
essentially identical to quadruple-channel configuration 5, except for the 
redundancy; therefore, the configuration 5 description is applicable. 

; The actuator configuration, includes a triple-driver*»actuator /triple- 
powei— actuator set on each control surface. 

The operational reliability for configuration 19 was determined with 

the aid of the success path diagram of Figure 92. A probability of loss of 

-7 

FCS function of 1. 7 x 10 per flight hour over an eight -hour flight period 
was -established. This value is not within the specified range. 


Configuration 20 

The sensor and cofnputation sections of configuration 20 are identical 
to configuration 18. The description of these sections is, consequently, 
directly applicable. 

A triple-driver-actuator /triple-power actuator arrangement is used in 
this configuration. An identical actuator arrangement is used in configuration 
19. It is also similar to the quad-driver /triple-power actuator arrangement 
used in configuration 1, except for the reduction in redundancy level. 
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Figure 91. - Configuration 18 Success Path Diagram 







Figure 92, - Configuration 19 Success Path Diagram 




The operational reliability or probability of loss of the FCS function 

-7 

was established to be 0. 13 x 10 per flight hour over an eight-hour period 
using the success path diagram shown in Figure 93. 


HARDWARE MECHANIZATION 

The tradeoff methodology defined "cost-of-ownership" to be the pri- 
mary factor for selection of the optimum configuration in this study. Conse- 
quently, it was necessary to use a consistent method to define the mechaniza- 
tion cost for each configuration. 

The cost of parts, components, etc., used in this study are strictly- 
best engineering estimates. They have not been reviewed nor approved by 
Honejrwell production or pricing departments. They include extrapolation to 
the 1978 time period but should not be construed to represent either present 
or future Honeywell component prices. Since the same parts arid prices are 
used throughout the study, comparisons should be valid. . 

The cost, weight and reliability values for hydraulics- and sensors 
used in the life cycle cost calculations are given in Table 24: 

The cost, weight and reliability values for the computational elec- 
tronics were determined by building up each configuration from component 
piece parts as described in the following paragraphs. 

Sixty different electronic modules were defined to provide the func- 
tions included in the analytical block diagrams of Section. 4. These 60 
modules include both analog and digital types. Only a part of the modules 
defined were used in anyone configuration. 
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Figure 93. - Configuration 20 Success Path Diagram 








table 24. - COST, WEIGHT AND RELIABILITY FOR 
HYDRAULICS AND SENSORS 


Component 

Cost, $ 

Weight, 

lbs 

MTBF, 

hrs 

Conventional gyro 

800 

0. 3 

10 000 

Laser gyro 

2250 

6.2 

30 000 

MHD 

gyro (two- axis) 

900 

0. 2 

25 000 

Conventional 

accelerometer 

800 

0. 25 

20 000 

Single-surface 
power actuator 

1500 

11. 0 

100 000 

Single driver 
actuator 

1000 

3.0 

48 000 

Single- integrated 
power actuator 

2500 

14.0 

75 000 


Twenty modules were used to mechanize the electronics portions of 
configurations 8, 13, and 13A (the most promising of the 24 configurations 
studied). The number of times the various functions (or modules) were used 
in a particular configuration was input to a computer program to sum up the 
numbers of each part, cost and requisite printed circuit board area. The 
resultant information, together with appropriate schematics and configuration 
hardware mechanization definitions, was input to the GEMM cost-of-ownership 
computation. 

The 20 modules are listed below along with figure references to their 
respective computer -printed parts lists and applicable circuit diagrams. 

• Demod excitor (Fig. 94, 95) 

• D-C analog input (Fig. 96, 97) 

• Discrete input (Fig. 98, 99) 

• A-C analog input (Fig. 100, 101) 
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• A/D converter (Fig. 102) 

• I/O control (Fig. 103, 104, 105) 

• DMA- control (Fig. 106,107) - 

• NRZ receiver (Fig. 108, 109) 

• NRZ register (Fig. 110, 111) 

• Manchester transmitter-receiver (Fig. 112, 113) 

• Sample /hold (Fig. 114, 115) 

• ; Processor cards (small) (Fig. 116) 

• Processor cards (medium) (Fig, 117) 

• Memory board (Fig. 118, 119) 

• Synchronizing logic (Fig. 120, 121) 

• Servo amplifier (Fig. 122, 123) 

• Discrete output (Fig. 124, 125) 

Discrete output (power) (Fig. 126) 

• • Power supply (Fig. 127) 

• Chassis parts (Fig. 128) 

An electronics piece-part catalog, shown in Figure 129, was estab- 
lished in a computer program. The piece parts in this catalog were used to 
mechanize the electronic modules in accordance with the schematics and 
parts lists. The parts lists and piece-part catalog include failure rates in 
percent per 1000 hours, cost in dollars and mounting area in square inches. 
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Function** oemoii excitor 



assehbly 

channel 3 

SYSTEM 

NO. 8 

part number 

part name 


UUan,N 

N*FAILURE rate 

N*COST rate 

N*AREA/PART 

MC1539 IC 

OP AMP 


1 

.0300U 

3,75000 

.24800 

2N2222A 

TRANS 


1 

.01300 

,33000 

.09300 

2N2907A 

TRANS 


] 

.01300 

,22000 

.09300 

iN4531 

DIOUE 


2 

.01800 

.05600 

.14000 

HL07 

resistor 


3 

.01500 

.42000 

.21000 

HN55 

RESISTOR 


7 

.03500 

2.45000 

.50400 

CK06 

CAP - 


2 

.00600 

.84000 ' 

' .12000 

' SOLDER CONNECT 



4d 

.00046 

0.00000 

0.00000 

total FUNCTION 

PARTS = 

17 





TOTAL FUNCTION 

FAILURE HATE 

s ^ 

13048 



TOTAL FUNCTION 

COST = 






TOTAL FUNCTION 

AREA : 

1 

.40800 

. r 




NUMBER or TIMES FUNCTION 
T'OTAL assembly PAc^Ts 

USEU = 3 

this FLiWCrlON r 

51 


FR • 

= 

.39144 


COST 

- 

24.26 


AREA 

= 

4,22400 



Figure 94, - Demod Excitor Parts List Printout 


4V +v +v +v 



Figure 95. - Demod Excitor Circuit Diagram 


248 



FUNCTION** OC ANALOG 

INPUT 

assembly 

. I : part number ' . 


PARI name 

UUaN, N 

' » LMIOIA 

IC 

CP AMP 

1 

LMllU 

iC 

CP AMP 

? 

1N4531 


DiOUF 

2 

RC07 


RESISTOR 

3 

RN55 


RESlSTCrt 

83 

CK06 


CAP 

48 

SN54U0 1C 



3 

SN5402 IC 



j. 

SN54u4 IC 



1 

nG506 IC 



3 

SOLDER. CONNECT 



426 


TOTAL rUMCTlON PARTS = 147 

TOTAL KU'JLTION FAILURE RATE = 
TOTAL' FUNCTION COST = 520.4? 

TOTAL FUNCTION AREA = 16.491100 


channel 3 

SYSTEM 

NO. 6 

n*failure Rate 

n*cost rate 

N*AREA/PART 

.03000 

40,00000 

.24800 

.06000 

40,00000 

.49600 

.01800 . 

,05600 

•14000 

.00300 

.10500 

.21000 

.41500 

29,05000 

5.97600 

.14400 

20.16000 

2.88000 

.09000 

6.30000 

1.62000 

. 03000 

2,10000 

,54000 

. 03q0Q 

2.65000 

.54000 

.12000 

180.00000 • 

3.84000 

.00426 

0.00000 

0.00000 


.94426 


number or TIMES FUNCTION USEU = 2 

TOTAL assembly PAPr$ THIS FUNCTION = 294 

FR = 1.88852 

COST = 640,84 

AREA = 32,98000 


Figure 96. - D-C Analog Input Parts List Printout 
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FUNCTION** DISCRtTK INPUT 


channel 3 

SVSTEN 

NO* B 

part nu'mber 

part NAHfc 

quan^n 

N*FAILURE rate 

n*cost rate 

N*AREA/PART 

2N2222A 


TRANS 

e 

.10400 

. 2.80000 

.74400 

2N2907A 


TRANS 

1 

.01300 

.22000 

.09300 

1N75X - 1N96X 

DIOUC 

6 

.12800 

1.60000 

.56000 

lN4b31 


niooE 

4« 

.43200 

1,34400 

3.36000 

RC07 


RfeSlSTtlH 


.02600 

.91000 

1.82000 

RL07 


RESISTOR 

96 

.48000 

13,44000 

6.72000 

RW79 


resistor 

1 

.01000 

.36000 

.20300 

SN54UI 

IC 


2 

.06000 

4.20000 

1.08000 


IC 


a 

.24000 

21.20000 

4.32000 

5N!j442 

lU 


1 

.04000 

13.00000 

.54000 

erarr 

IC 


1 

.04000 

28.00000 

.54000 

RELAY 



t 

.04000 

4.10000 

0.00000 

SOLDliH CONNECT 


559 

.00559 

0.00000 

0.00000 

total 

rUNCTION 

PARTS * 201 





TOTAL. 

rUNCTlON 

FAILURE RATE 

= 1, 

.61859 



TOTAL 

FUNCTION 

COST = 

91.17 




total 

FUNCTION 

AREA s 19 

.96000 





I^UHBER OF TIMbS FUNCTIOH UStU • 'i 

lOT^.L parts fOP THIS FCNCTIUN a 402 

FH = 3.23718 

COST = 182.35 

ARUA a 39.96006 


Figure 98. “ Discrete Input Parts List Printout 
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Figure 99. - Input and Signal Conditioning Circuit Diagram 




function** AC 

analog input v5 

assembly 

channel 3 

SYSTEM 

oo 

o 

z 

PART NUM8ER 

PART NAME 

QUAN,N 

NtFAlLURE Rate 

N*COST RATE 

N.AREA/P.ART 

LMllO 

IC 

OP AMP 

1 

.03000 

20,00000 

.24800 

3N179 


DIOUE 

21 

.31500 

129,15000 

1.95300 

1N4531 


DIODE 

2 

.oiaoo 

.05600 

.14000 

RN55 


RESISTOR 

44 

.22000 

15,40000 

3.16800 

CK06 


CAP 

23 

.06900 

9,66000 

1.38000 

1510 


CAF* 

21 

.06300 

3,15000 

5.25000 

SN54U0 

IC 


1 

. 03000 

2.10000 

.54000 

SN54U2 

IC 


1 

.03000 

2,10000 

.54000 

SN5404 

JC 


1 

.03000 

2,65000 

.54000 

DG506 

IC 


2 

. 08000 

120,00000 

2.56000 

10030771 


XFONMEH 

21 

.21000 

126.00000 

5.25000 

SOLObR CONNKCT 


474 

.00474 

0,00000 

0.00000 

total 

FUNCTION 

PARTS = 138 





total 

FUNCTION 

FAILURE HATE 

= 1. 

09974 



TOTAL 

FUNCTION 

COST = 

430.27 




TOTAL 

FUNCTION 

area = 21 

.56900 





number of times function USEU = 2 

TOTAL assembly PARTS TOR THIS FUNCTION 
f'R - 

COST = 

area = 


276 

2 , 199-18 

660,53 

43il388e 


Figure 100, - A-C Analog Input Parts List Printout 
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fUNCfIOIV«» A/i) COfJVKHTtH 


ASSPhtHLY channel 3 


SYSTEM NO. e 


PART fJUHDER 

part (VlAMfc 

OUAN , N 

N^^FAILURE RATE 

N*COST RATE 

N.AREA/PART 

y.A74L 1C 

OP aPP 

1 

.03001) 

1.05000 

.24800 

LMlll iC 

OP Aflp 

1 

.03000 

26.00000 

.24800 

LMTIH IC 

OP ANP 

Jr: 

.osoon 

64.00000 

.49600 

2N2222A 

tra.ms 

lA 

.lb2U0 

4.90000 

1.30200 

2rJ29e7A 

TKAijS 

26 

.33800 

5.72000 

2.41800 

1N75X - INVaX 

DIOUE 

3 

.048U0 

•60000 

.21000 

1NR27A 

niOiJE 

1. 

.01600 

11,50000 

. 07000 

llV^53i 

III OOP 

10 

.09000 

.26000 

.70000 

RC07 

HfcSISTCR 

12 

.01200 

.42000 

.64000 

RL07 

HfcSlSTCR 

49 

.24500 

6.66000 

3.43000 

RN55 

RbSisrcrt 

12 

.06000 

4.20000 

.86400 

CKOt) 

CAP 

6 

,0240(1 

3.3600U 

. 40000 

CSP13 . 

CAP 

1 

,00300 

.42000 

.47900 

SN5400 iC 


2 

.06000 

4.20000 

1.08000 

SN54U1 IC . 


7 

.21000 

14.70000 

3.78000 

SN54U4 1C 


2 

.06000 

5.30000 

1.08000 

CNb41C iC 


1 

.03000 

.2.10000 

.54000 

SN5442 IC 


2 

.08000 

26.00000 

1.08000 

SN5473 IC 


1 

.04000 

2.75000 

.54000 

SN54f^3 1C 


2 

.08000 

9,44000 

1.08000 

SNS4174 IC 


2 

.08000 

15.90000 

1.08000 

IC 


3 

,12000 

22.35000 

1.62000 

IC 


-t 

. 0 ^ 0 0 n 

60-00000 

1.28000 

SOLMHR CONfircT 


690 

.00690 

0.00000 

0 .00000 

total rUNCTION 

PARTS = 16aT 





totmi. function 

failure rail 

= 1, 

,96490 



TOTAL F'Uf-CTION 

COST = 

294.05- 




total ruiCTJOR 

A h fc A = 2 4 

. 94500 





N'.«nntR 

•)f TlfiHS Ml!MCTI0^» 

liSHiJ 

= X 


TCi AL 

A^SLhHLY FAPic 

fr 

COST 
A R I : 

^ FOR 

THIi, 

F .1. nC I i UN ' 

163 

1 .96490 
294. OS 
24.94500 


Figure 102. - A/D Converter Parts List Printout 


FUi>lCTION** I/O 

CONTROL 


assehblt 

CHANNEL 3 

SYSTEM 

NO. 8 

PART N’JMQER 

part NAflE 

OUAN,N 

n^failure Kate 

N*COST RATE 

N*AREA/PART 

RL07 


resistor 

3 

.01500 

.42000 

.21000 

CKD6 


CAP 

3 

.00900 

1.26000 

.18000 

SN54U0 

IC 


5 

.15000 

10.50000 

2.70000 

SN54U3 

fC 


6 

.IdOOO 

12,60000 

3.24000 

SN54U4 

1C 


5 

.15000 

13.25000 

2.70000 

SN5410 

I C 


3 

.09000 

6.30000 

1.62000 

SN5420 

I c 


2 

.06000 

4.20000 

1.08000 

Sn5h42 

IC 


6 

.24000 

78.QQQQ0 

3.24000 

SN5473 

I c 


3 

.12000 

8.25000 

1.62000 

SN'5475 

IC 


■ 4 

.16000 

16.84000 

2.16000 

8T83P 

IC 


5 

.20000 

140,00000 

2.70000 

SOLDER CO'nIMECT 


556 

.00558 

0.00000 

0.00000 

TOTAL 

FUNCT ION 

PARTS = 45 





total 

FuVCTIO-V 

FAILURE RA.IE 

5 1, 

,37958 



TOTAL 

FUnCT I ON 

COST = 

291.62 




total 

FjNCT ION 

AREA = 21 

.45000 





OF Tiy.^S FUNCTIQfg UStU = I 
total AssHM'dLY ?A'-<TS ^“0“^ THIS FlmCtION 
FH = 

COST = 

AJ^EA - 


^0 

2.75916 
583, 2A 
^2 .9Q0BQ 


Figure 103. - I/O Control Parts List Printout 
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? T 

+v . +v 

ONE SHOT [ 
4USEC 


4-V -^V 


■J Q READY 

(TOMTU) 

■ CLK . 

■ K .5 


■ LOAD CPU RE6»STER/AD 


counter 

CLOCK 



control 

ADDRESS 

INPUTS 


RAM 
« MULTI 
ADDRESS 


RAM 

OUTSIDE 

ADDRESS 


LOAD RAM 

FR DISCRETE 

■RAM REAO/WRITE 


RAM 

ADDRESS 


Figure 104. - I/O Control Logic 













Figure 105. - Avionics /Flight Control Bus Interface 







fUNCTlON** DMA 

CONTROL 


ASSEH8L.Y 

CHANNEL 3 

SYST6H 

NO. 8 - 

part numbkr 

part name 

0UA*>f«N 

ntfailure Rate 

N*COST rate 

n«area/part 

■ 1N0531 


UJOUE 

s 

.02700 

.08400 

.21000 

. RN55 


RcSlSTOU 

4 

.02000 

1.40000 

.28800 

. CKO 6 


CAP ,j 

4 

.01200 

1,66000 

.24000 

SNS4U0 

IC 


S 

.19000 

10.50000 

■2.70000 

, SN54U3 

h; 


2 

.06000 

4.20000 

1.08000 

SN54U4 

IC 


3 

.09000 

7.95000 

1.62000 

SN5442 

IC 


/ A 

.04000 

13.00000 

.54000 

SNS493 

IC 

' 

^ 2 

.08000 

9.44000 

i. 08000 

SOLDEK connect 


204 

.00204 

0.00000 

6.00000 

total 

Function 

PANTS s 24 





total 

FUNCTION 

FAILORI: NATc 


48104 



total 

function 

COST s 

48.25 




total 

FUNCTION 

AHEA : 7 

.75800 





NUMBER OF TIMES FUNCTION USED * 2 

total assEmalt parts for this FlueilON a 

48 


FR a 

.96286 


COST a 

96.51 


AREA a 

15.51608 


Figure 106. - DMA 

Control Parts List Printout 




DMAf^L 


OMAU 

RESET NO. I 


RESET NO. 2. 


Figure 107. -DMA ContrjDl Circuit Diagram 
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FUNCTION** NRZ RliCfi’lvER 


assembly 

CHANNEL 3 

SYSTEM 

NO. 8 

. ’|i'AKT* NUMBER ■- ‘ 

Part nahe^ 

uuan.n 

n'Failure Rate 

NACOSY RATE 

N*AREA/PART 

' MA741 IC 

op amp 

1 

.03000 

1.05000 

.24800 

■ •' 2N2222A 

TRANS 

1 

.01300 

,35000 

.09300 

''•^2N29U7A 

TRANS 

1 

.01300 

.22000 

.09300 

■ "1N75X - iN9t)X ' 
,.'VRN55 

UlOUt 

2 

.03200 

,40000 

. .14000 

RtSISTCR 

15 

.07500 

5.25000 

1.08000 

, SN54U0 1C . • • 


1 

.0300U 

2.10000 

.54000 

SN54II4 IC ' 


1 

.03000 

2.65000 

•54000 

SbLDKR CONNECT ’ 

• • total function 

PARTS = 22 

32 

.00082 

0 .00000 

O.UOOOO 

total function 

FAll URt NATE 

= 

22382 



total ruNcrtOM 

COST = 

12.02 




TOTAL FUNCTION 

AptA = 2 

.73400 





NUMBER OF TIMES FUNCTION 

USED = 1 


total assemblt parts for 

this ruNcrroN = 

22 

FR 

= 

.22382 

COST 

- 

12,02 

AREA 

= 

2.73408 


Figure 108. * NRZ Receiver Parts List Printout 



Figure 109. - NRZ Receiver Circuit Diagram 
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function** njr^ 

REGISTER 

- 32 RIT aSSEHc*LY 

channel 3 

SYSTEM 

NO. 8 

PART Njr1«tR 


part name ouan,n 

n*failure Rate 

N*COST RATE 

n*area/part 

1N4I3J1 


OIOUE 1 ■ 

.00900 

.02800 

.07000 

RN55 


resistor 2 

.OlOUO 

.70000 

.14400 

CK06 


CAP 3 

.00900 

1,26000 

,18000 

SNS400 

IC 

3 

.09000 

. • 6,30000 

^ Y . 1:.62000 

SNS4U1 

IC 

b 

.24000 

16,80000 

4.32000 

SN*>4U4 

IC ^ 

i 3 ^ 2 

.06000 

5,30000 

"V'08000 

SNS495 

IC ‘ 

j b 

.24000 

88,00000 

• 4.32000 

SN54122 

IC 

1 

.03000 

5,69000 

' ,54000 

SOLOEH connect 

• I 320 

.00320 

0.00000 

•O.QOOOO 

total 

FUNCTION 

PARTS s ) 28. 




total 

FUNCTION 

FAILURE RATE s 

69120 


■ - F • 

total 

FUNCTION 

COST = 124.06 



'•iy- , 

total 

FUNCTION 

AREA = 12.27400 




NUMBER OF TIMES' FUNCTION 

USED = 1 




TOTAL assembly 

parts POr 

THIS function = 28 





TR = ,69120 

Cost = i24.oa 

ARtA 2 12,27400 


Figure 110. - NRZ Register Parts List Printout 



FROM DMA CONTROL 

Figure 111. - NRZ Register Circuit Diagram 
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rUNC-UON** 

C^ibS ■ PR 

TRA\S-rtrVT 

assphhly 

CHAfJNRL i 

SYSTEM 

' NO. 6 

...PART 

:- 

PAP1 NA'ic 


N*KAlLURt RATE 

N*COST rate 

N*ARE-A/PART 

RC0 7 


PkSISTCK 

6 

.00600 

.31000 

.42000 

, ; 

:'c. . . 


3 

.09000 

6.30000 

1.62000 

r : . SNb^bl 

J C- 


6 

.ibouu 

13.60000' 

3.24000 

SNb<Uii? 

; C 


3 

,t0900U r 

6.-30000 

1.62000 

SN5^U4 

i’C 


6 

. 0900U 

, 7.95000 

1.62000 

SN^'tlC 

1 u 


3 

. ’ .09000 

' . 6.30000 

1.62000 

SN5<2G 

!C 


1 

. .C3000 

2.10000 

.54000 

SN5473 

:c 


& 

. ? 0 0 0 U 

13,75000 

2.70000 


I c 


2 

.Otioor 

9.44000 

1.08000 

SN^<tC7 

ic 


1 

. C300G 

3.89000 

.54000 

SN5419B 

:c 


5 

.12000 

42.87000 

1.62000 

SN55109 

I c 


1 

.04000 

6.15000 

.54000 

SOLDEP CON 

^bCT 


4a|6 

.00446 

0.00000 

- 0.00000 


TOTUL FO-'CTION PAHTSi s 67 
total fUAiCTjnM fAJLORc RATE * , i.OSOAA 

total FiJfiCTION COST r 117.86 

total function AHfcA S 17.16000 


NUMBER OF TIKES FUNCTION USEO * l3 
T0TA| ASSEmUl'^ parts FOR ThIS FLnCTION s 

* 13.655V8 
COST s 1533.18 
AREA .. s' 223.08000 


Figure 112. - Manchester Transmitter-Receiver Parts List Printout 
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Figure 113. - Manchester Transmitter-Receiver Circuit Diagram 










T10N*» SA-4^^:.’d/fiOLU 


aSSl-phlY 

channel S 

SYSTEM 

NO. 6 

PART 

PAPl 

UUAN, N 

N*PA1LURE PATE 

N*COST rate 

N*AREA/PART 

;‘iA741 IC 

OP AilP 

1 

. 03QU0 

1.05000 

.24800 

LMii'i n: 

OP AMP 

1 - 

.03000 

. 2U .0000 0 

.24600 

N P 9 U / A 

fPANS 

1 

- 01300 

•22000 

.09300 


T P A N S 

1 

.07100 

1.43000 

.09300 

INAtj/ 

oioot 

1. 

.OlAOU 

.16000 

.07000 

^C07 

PtSISTCK 

6 

. OGSUO 

.28000 

,56000 

r.KfJo 

CAP 

1 

. 0 U 3 0 U 

.42000 

.06000 


GAP 

J 

.02400 

2.4400 0 

.20000 

SOL‘Jh'^ CUNijJCT 


S6 

.00056 

0.00000 

0.00000 

r . TO TAi. ru'Ji; r i o.-v 

PAPTo r 15 





T G r L r' 0 N‘ c r I On 

?AiLOPt pAFE 

= 

,19356 



total rUNJTION 

COST = 

e> • i) 0 




^ total ruNcriON 

Ai^tA - 1 

.S7200 





or T!«.t'S FOMCTIOM USF.U = 13 
I'ITAL >»AR(s FOi< THIs FL■^JCrIU^ 

FH ■ : 

COST = 

AHSA : 


4 

195 

2.5A228 
338 . OU 
20.4360U 


Figure 114. - Sample /Hold Parts List Printout 


+V +V INPUT 



Figure 115. - Sample /Hold Circuit Diagram 
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ni.NCTION** PROCeSSOR 

(SHALL) 

ASSEMiiJLY 

CHANNEL 3 

SYSTEM 

NO. . 8 . 

P;aRT 

part WArtt 

"UilAN, iM 

nafailure hate 

N*cdST RATE 

N*AREA/PART 

;2N?2;»?A 

‘ TRA.^S 

4 

.052011 

1.40000 

.37200 

2N2VU7A 

. .. txans 

. • HcsisrcN^^ 

4 

.05200 

.88000 

. .37200 


.-•0 

.06000 

4.20000 

.86400 

‘ 'F>KOCESSaR-MbM 

' ( small* 

2 

7.00000 

4000.00000 

43.20000 

'SnLD.LN CONULCT '/ 


• 4d 

.00048 

0,00000 

0.00000 


TOTAL f'UNCTiON HAHTS = 

TOTAL RJL'CTIO.Si fAlLURb kATE = 7.16448 

TOTAL FUK'CTiON COST = 4MU6.46 

total function area -= 44.a0H0n 


NUrtPER OF" TIMES f ONC T I ON ;U.SfcU = 1 

TOjAL F>A{lrs THI^ function - '^2 

TR , * . = ‘ 7.1644b 

COST = ’ 4U06.48 

aP^A = 44,80800 


Figure 116. - Processor Cards (Small) Parts List Printout 



fUiMCTION** PHOceSSOR CaROS. 5 ASStPRLY rCHANNtL -3 i . - SYSTEM NO. 8 


PART NUMBER PART NAME OUAN.N N*fAlLUR6 HATE N»COST RATE N*AREA/PART 

PROCESSOR (MED) CA«U 1 4.50000 SOOO. 00000 21.60000 

TOTAL FUNCTION PARTS =■■ '1 ■ - 

TOTAL FUNCTION FAILURE RAJE * 4.50060 

TOTAL FUNCTION COST = .I 3000.00 , ... 

total function area i '21.60000 


NUMBER OF times FUNCTION USEU ^ 1 

TOTAL Assembly parts eoh this FUNCr-iON = . . i. 

FR = 4.50006 

COST = - 3000.00 ' - 

AREA = 21.60000 


Figure 117. - Processor Cards (Medium) Parts List Printout 


T UNCI hOaRU 


ASSbMRLY- CHANNEL 3 

SYSTEM 

NO. 6 

HAKr Nli^HL'K 


part N^.lb 

(JUAN, 

N N*F^AI.LURE RATE 

N*COST RATE 

N*AREA/PART 

HN??3N9A 


trans 

1 

.01300 

.10000 

.14200 

?N^64t> 


TRANS 


.07100 

.86000 

.04000 

2N6C6/ 


TRANS 

1 

.07100 

.93000 

.04000 

1N44U4 


IJIOJH 

2 

.03200 

.18000 

.14000 

\icuy ‘ 

■ ■ ' 

fitrSlSTCK 

6 

* • .00600 

.21000 

.42000 

, RCPO 


RbSlSTC-K 

i 

.00100 

.03700 

.12800 

...^:cK0o ' 

*■ ^ ’ 

'CAP 

/ ■ 6 

' .02400 

3.3600.0 

.46000 



CAP 

A 

.01200 

1.68000 

1.91600 

• 1003401^ 

■* 

CAP 

1 

.04000 

8.00000 

8.00000 

.V!;^n!>4ui 

Ju ‘ ' 


. J 

.03000 

2.10000 

.54000 


i u , , 


■ 2 

.06000 

4.20000 

' 1.06000 

'SN*i4ii 4 

1.; 



,15000 . 

13.25000 

2.70000 

Sn’?a1 U 



J 

.03000 

2.10000 

.54000 

SN‘>4107 

I c 


1 

.03000 

3.89000 

.54000 

S(N‘>41‘J3 

h: 


1 

.04000 

5.47000 

.54000 

SN‘>41t>5 

10 


•J. 

.04000 

7.02000 

.54000 

SN*>41dn 

J 0 


2 

.08000 

37.60000 

1. 06000 


l-J 


2 

.03000 

6.84000 

1.06000 


IC 

PR0.1 

21 

.84000 

1260.00000 

11.34000 

!h6^iP3 

IC 

RAM 

16 

.64000 

560.00000 

8.64000 

rlU 1 

1C 


4 

.16000 

' 54.40000 

2.16000 

SOL.OlR CUNNhUr 


8pl 

.00851 

0.00000 

0.00000 

rOTAI. 

r Jr.'CT ION 

PARTS = 

62 




rurAi. 

riJJOT lOiN 

P A I L uRb R A r c = 

2,45851 



totai. 

KUNOT ION 

COST = 

1974.23 




1 ofai. 

rUMOTION 

ARt A = 

42.08600 





NUri^br*? -M' I- unction Uiibii = 4 

lOfAL Ass^'^'^IY FVmivjc, roi? T.Hls H'MCrTON = 628 

► P = .9.83404 

tjUiiT = 7896 . 91 

AKfjA = 168.34400 


Figure 118. - Memory Board Parts List Printout 





Figure 119. - Memory Board Circuit Diagram 
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FUNCTION** SYMCHKONIZING 

; LORir 

ASShKfILV 

CHANNEL 3 

SYSTEH 

NO. 8^ 

part numbfr 

PAR) ^4AHE . UUaN.N 

N*FAlLURfc HATE 

N*COST RATE 

n*area/part 

SN5400 1C 


3 

.0900U 

6,30000 

1.62000 

SN540< 1C 


3 

.03000 

2,65000 

.54000 

SN5420 1C 


1 

.03000 

2.10000 

. , .54000 

SN*)4/3 IC . 


; ? 

.08000 

5,50000 

1.08000 

. SN*)4122 IC 


1 

' .03000 

5.69000 

.54000 

SOLCCR COiJNECT ' 


31? 

.0011?. 

0,00000 

b.poooo 

total Function 

PANTS = 

e 



r 

TOTAL FUNCTION 

FAlLURfc 

NATE => 

26112 



TOTAL T'OCCTIOn 

COST = 

22. 




total function 

ARbA = 

4.32000 





Nl'MpHR OF TlAh'C. M;NCTIUN 
total PaI ^3 FOH 

CSFi) = 1 

7 H Ivj FlnC 1 I uN = 

3 


FR 

= 

,26112 


COST 

= 

22.24 

A 

\^I:k 

= 

4,32000 



Figure 120. - Synchronizing Logic Parts List Printout 


VALID A 
AV 

sync A 


zo 







VAUOB— 


SYNC B 


VALID O 
OV 


SYNC 



VALID C— i—v, 
CV— 1-^ 


SVNC C 


HEXO 


Figure 121.- Synchronizing Logic Circuit Diagram 
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bt-^7) ArlPLiribH 

ASS^M^X Y 

channel 3 

SYSTEM 

NO. 8 

PAhI wUNiir.i 


Part na.-j 

>r 00AAJ,M 

N*FAlLURt PATE 

N*cosT Rate 

m.area/haht 

MA741 

IC 

OP amp 

1 

.0300U 

1.05000 

.24800 



T H AinR 

1 

.01300 

.35000 

.09300 

2N-79J7A 


TPA‘<S 

> 

.02600 

.44000 

.18600 

2N4392 


THAnS 

\ 

.07100 

1.43000 

.09300 

3N179 


DIOUF 

2 

.03000 

12.30000 

.18600 



01 OOP 

1 

.01600 

.16000 

.07000 

RN’J'i 


R t S 1 S T 0 

15 

.07500 

5.25000 

1.08000 

ckno 


CAP 

3 

.00900 

1.26000 

.18000 

151J 


Cap 

? 

.00600 

.30000 

.50000 

8T90 

IC 


I 

.04000 

28.00000 

.54000 

SOLDER COni^ 

IcCT 


90 

.00090 

0.00000 

0.00000 

total 

FUNCTION 

pa^^ts = 

29 




total 

function 

FAILURE hate a 

.31690 



total 

function 

COST = 

S0.5« 




total 

function 

AREA = 

3.17600 





NUdHER OF TIMES FOMCTION USED = U 

TOTAL AssEHMlV ?ARt 5 FQH tHI^ FUdCflON a 377 

fO a 4.li970 

COST a 657.02 

AREA a 41.20800 


Figure 122. - Servo Amplifier Parts List Printout 



-V 


Figure 123. - Servo Amplifier Circuit Diagram 
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T 

part WA^e QUAN.N 

?Vu7A 

TRA.siS 13 

0 7 

RcSISTOR SO 

0 6 

CAP « 

IC 

3 

iZ 

J 

5475- I'J - 

' « 

VO {•: 

3 

fjdH CJnJ'J-jJT 

iOl 

total >onction 

PARTS = 78 

rOTAL S'U:VCT|OW 

FAlLOPt RATE = .-6 

TOTAL rUNOTIOtg 

COST = H6.0o 

total I‘uN!CT10;>I 

AREA = lOidaVOO 

OF times FUiMCriUN 

USFO = S 

i^^EMbLY VAi^T5 F0>? 

this FO.^CfluN = 2S4 

r S 

= 1,90 

COS r 

= 348 

area 

- y^,bb 


♦fAlLURE HATE 

N*COST RATE 

N.AREA/PART 


.16900 

2 .86000 

1.2090 


. 0500U 

1.75000 

3.5000 


.01*200 

1.68000 

.2400 


. 09000 

6.30000 

1.6200 


.03000 

2.65000 

.5400 


.16000 

16.84000 

""2.1600 


.12000 

84.00000 

1.6200 


; 00301 

U. 00000 

0 ; 0 0 0 0 

401 • 




03 




24 




00 





1 






SYSTEM NO. .8 


FUNn;TIU-^** OUTPUT (PONf.rM ASSlJPr<LT CHAM^EL 3 


part njUHMH.-: 


pawt ua 

UUa«\,K' N*r AlL'JRt WaTF 

N^COST rate 

N*AREA/PART 

?N^9(.o 


TWAfJS 


.92 500 

36.92000 

20.80000 

1 


cinui: 

IP 

.11700 

.97500 

.91000 

RC0 7 


HbSiSTC 

n SO 

.0503'J 

1.75000 

3.50000 

CKC;6 


CAP 

4 

.ni?0'j 

1.680U0 

.24000 

SN'^'tuf; 

i C 


P 

.OVO JO 

6.30000 

1.62000 


Ic 


J 

,03030 

2.65000 

.54000 

SNb^/? 

II 


4 

.16000 

16.64000 

2.16000 

PT9T 

IC 


3 

.12300 

84.00000 

1.62000 

SOLiitf^ CON'v 

crCT 



.00327 

0.00000 

0.00000 

total 

r uMt-T I CM 

PARTS = 

91 




TOT^L 

T UfL 1 ION 

F A ILUPb 

kAFP = 1.505^7 




total 

FUNCTION 

LOST r 

151. 11 i 




TOTAL 

F Lr.tT ION 

AHfcA r 

il..<V>IOo 




number of TI.SES 

Function 

LSPb = 





IOtAL As^;eMBLY 

BaKic for 

Tnic FL 

ivCiluN = 91 




FP 



= 1.S0527 




CnS 

T 


= 151.11 




AWL 

A 


'= Pl,390U'j 





Figure 126. - Discrete Output (Power) Parts List Printout 
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FiHcnOiN-* PowEH suppur 


ASStPC«Ly 

CHANNEL 3 

SYSTEM 

NO. 8t 

PART WUMbER 

PART NAflt 

OUAN,N 

N4FA1LURE RATE 

N^COST RATE 

N*AREA/PART 

MA741 

1C 

OP AMP 

1 

•03000 

1.05000 

•24600 

2Nlol3 


TRANS 

1 

.01500 

•34000 

.14200 

2N2222A 


TRANS 

6 

.07800 

2.10000 

.55800 

2N29'Ji?A 


TRANS 

1 

.0X300 

•24000 

•14200 

?N?9u7A 


TRANS 

15 

.19500 

3.30000 

1.39500 

2Ni0l9 


FRANS 

1 

.01300 

•25000 

.14200 



TRANS 

4 

.01300 

3.18000 

.19000 

2N39H0 


Trans 

2 - 

.02600 

4.50000 

.16600 

2N42:M 


TRANS 

1 

.01300 

1.44000 

.14200 

2N4b9rt 


TRANS 

1 

.07100 

2,61000 

.75000 

2N49II1 


TRANS 

1 

.07100 

3.03000 

1.60000 

2N491U 


T R A N S 

2 

.14200 

5.10000 

1.50000 

2N‘3067 


T R A N S 

1 

.07100 

2.70000 

1.60000 

2N^6a3 


TR Ai>iS 

1 

.07100 

18.50000 

1.60000 

tN64‘i 


UlOiiP 

31 

.27900 

2.32500 

2.17000 

1N7^X - li4‘,»bX 

r. loop 

13 

.20H0O 

2.60000 

.91000 

lN.1.1d3 


IUOa^P 

4 

.06400 

7.20000 

1.80000 

1 N39Vy 


UIOjP 

1 

.01600 

10.95000 

.19000 

lN4ii3l 


MIOUP 

7 

.06300 

.19600 

.49000 

lN499a 


iHOUP 

17 

.83300 

12.41000 

4.25000 

!U; 0 7 


RtSISTOR 

42 

.04200 

1.47000 

2.94000 

HC20 


KtSISlCR 

2 

.00200 

.07400 

.25600 

KLU7 


rhsistor 

26 

.13000 

3.64000 

1.62000 

r?N^ib 


R t; S 1 S T C K 

17 

.06500 

5.95000 

1.22400 

f?N6i; 


r^csisTOR 

5 

.01500 

1.11000 

.36100 

■pr22 


RtSiSTCR 

3 

.01500 

3.90000 i 

1.20000 



RfcS 1 S T C K 

6 

.06000 

2.04000 

.60600 

f?W79 


RtSiSTCR 

6 

•0600U 

2.16000 

1.21800 

RL20 


RtSISTOK 

A 

.04000 

•9600C 

1.00000 

CKO 6 


CAP 

20 

.06000 

8.40000 

1.20000 



CAf’ 

5- 

.01500 

2.1000U 

2;39500 

CU13 


Cap 

7 

.16800 

9.17000 

4.55000 

150D 


CAP 

3 

.00900 

.45000 

.13500 

3N‘J4(iO 

IC 


6 

. 09000 

6*30000 

1.62000 

S N ‘j 4 1 j 4 

u: 


1. 

.03000 

2.65000 

.54000 

SNS40b 

1C 


1 

.03000 

. 2.65000 

.54000 

SN^4122 

1C 


1 

.03000 

5.69000 

.54000 

BTdCK 

IC 


4 

.16000 

112.00000 

2.16000 

10030697 


XF OKMfcR 

1 

.14500 

46.45000 

0.00000 

SOLDL-U CONNhCT 


704 

.00704 

0.00000 

0.00000 

Tor AL 

njllC T ION 

PARTS = .267 





total 

fUiJCT ION 

FAiLURt RAlt 

= 3. 

478U4 

, 


TOTAL. 

FUnCTlON 

COST =‘ 

301,3d 




total 

function 

ARtA - 44 

. 33000 





NUMBER 

nf TIMES MJNCTION 

USHl) = 

1 


TOTAL 

Asst^l^LY PAd IS 

IHls. FI 

;NC r lUN 

= 267 


FR 


= 

3.47804 

'*■ ’• . 

COST 



301.38 


ARtJA 


- 

44.33000 


Figure 127. - Power Supply Parts List Printout 
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^tJNCTIO^'•* CHASSIS PARTS 


ASStMfeLT 


channel 3 


SVSTEM NO. 8 


part wUfiOtK 

PART name 

OUAIM^N 

N^FAltURE RATE 

N*COST RATE 

N*AREA/PART 

■RCi^O 

Rts ; stcr 

1 

.00100 

,03700 

.12800 

CM07 

CAP 

1 

.02400 

1.50000 

.50000 

10034012 

CAP 

3 

.20000 

40.00000 

40.00000 

24K2HCT 

xrORrttiR 

1 

.10000 

20 .30000 

0.00000 

RtUAY 


1 

.04000 

4,10000 

0.00000 

BMI KUTPH 


2 

.03600 

8.88000 

0.00000 

•SOLi^tR CO\f>/fc*CT 


30 

.00030 

0.00000 

0.00000 

total KUMCTION 

PARTS = 11 





total rOMCTlON 

FAlLURt HATE 

2 

.40130 



total rj.\CTION 

COST = 

74.62 




total ro*>lCTlON 

area = 40 

.62800 





NUMBER OF r lilts FUNCTION USED = 1 

TOTAL AsstNdLT PApTS f'OR THIS FUNCTION 
Fh = 

COST = 

area = 


11 

.40130 

74,82 

40.62890 


Figure 128. - Chassis Parts List Printout 
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Part Description 

Rel 

Cost 

Area 

1 

MA741 

ic 

140P AMP 

•03000 

1:05000 

.24B0D 

2 

LMIOIA 

IC 

14UP amp 

*03000 

4 ( 1 .00000 

.24800 

3 

IMIIO 

IC 

140P amp 

.03000 

20 .00000 

.24600 


LMlll 

IC 

140P AMP 

.03000 

28:00000 

.24B00 

b 

LMllb 

IC 

14UP AMP 

.04000 

32 .00000 

.24800 

6 

MC1539 

1C 

140P AMP 

.03000 

3.75000 

. 24B00 

7 

2N930 


3TRAM5 

. 0 1 5.0 0 

.20000 

.09300 

b 

2M613 


3TRAMS 

.01500 

. 34000 

, . 14200 

9 

2N2222A 


3TRANS 

.01300 

.35000 

. ,.09300 

10 

2N.'2369 A 


3TRANS 

.01300 

.100.0 0 

' , 14200 

11 

2N2432A = ' 


3TRANS 

.01300' 

1.25000 

.14200 

12 

2N2905A 


3TrAK'S 

,01300 

.24000 

.14200 

13 

2N2907A 


3TPANS 

.01300 

.22000 

■ .09300 

14 

2IM2946A 


3TRAMS 

.01300 

4TOOOOO 

■ . 14200 

15 

2N3019 


3TRA^S 

.01300 

’.25000 

; .14200 

16 

2N3716 


3TRANS 

.01300 

13.55000 

. 14200 

17 

2N3896 


3TRANS 

.01300 

3.10000 

■;19U00 

lb 

2^3960 


3TRAMS 

.01300' 

2.25000 

.09300 

19 

2fvj4234 


3 TR A|\ib 

•01300 

1.44000 

.14200 

20 

2N4392 


3TrANS 

,07100. 

1:43000 

.09300 

21 

2N4b9d 


3TRANS 

.07100 

2.81000 

. 75000 

22 

2'vJ4901 


3 T R A N 5 

.07100 

3:03000 

i .601)00 

23 

2!'j49Qi 


3TRANS 

.07100 

2.84000 

1.60000 

24 

2*N/4910 


3 FRANS 

.07100 

2.55000 

. 75000 

25 

2 !\l 5 0 6 7 


3 TrANS 

• 071 00 . 

2.70UOO 

1.60000 

26 

2:\'5633 


3 Trans 

.1)7100 

18 .5fjnoo 

I. 600 OU 

27 

2rj5b45 


3 trams 

.07100 

.86000 

' . U4U00 

2b 

' 2 N 6 0 6 7 


sS T R A N S 

.07100 ■ 

.93000 

.04000 

29 

3!U79 


4UlU0t 

. 01500 

6 . 15000 

'■ . 09300 

30 

S!\543:J IC 


14 

. U 3 0 0 0 ' 

2.10000 

.54000 

31 

1TM457 


2U lOUt 

.01600 

. 16000 

.07000 

32 

1N645 


2D runt 

,00900 

.0 7500 

.. 07000 

33' 

1D75X - 1N96X 


2UIODt 

. 0161)0 

.20000 

. ' .07000 

34' 

ir.i«27A 


2UlODt 

. H1600 

1 1 . 5 U 0 0 0 

.07000 

35 

irUlb3 


2uiont 

. U1600 ■ 

1 .80000 

.45000 

36 

lNi361i 


2UIunb 

. 01600 

.35000 

' .04600 

37 

1N399’» 


PDIOIjb 

. C160U 

10 . 95000 

■' . 19000 

38 

ir4<*54 


2UIorb 

, ij 1 6 0 0 

,09000 

. . 07000 

39 

1N4531 


2UIUDt 

, U0900 

. 02800 

' . 07000 

40 

1 N 4 9 9 b 


2UIO[.!b 

,04900' 

.73000 

.25000 

41 

SPAPt 41 


“OUlOUt 

-n. 00000 

-0 .00000 

-0.00000 

42 

RC07 


2RbSlS70R 

‘ , 0010 c 

.03500 

. .07000 

43 

RC2U 


2RESISTUR 

.00100 

.03700 

.12BOO 

44 

RLQ7 


2RPSIST0R 

, 00500 

.14000 

.07000 

45 

KN55 


2RfcSI STOR 

. 005d0 

.35000 

.07200 

46 

RfvibO 


2RPSISTOR 

.C050C 

. 37000 

.12700 

47 

RT22 


2RPS ISTOR 

. G0500 

1.30000 . 

. 40000 

48 

R w 7 U 


2RES I STUR 

.01000' 

.340 00 

■ .10100 

49 

Rv<79 


2RPSISTOR 

.01000 

.36000 

.20300 

50 

RL20 


2RPSIST0R 

.00500 

. 12000 

.12B00 

.51 

PROCESSO.R-M3M 


-0.(SMALU 

3.500 0U200-0 .00000 

21.60000 


Figure 129. - Electronic Piece-Part Catalog Printout 



Part Description 

Rel 

Cost 

Area 

52- 

CK06 



2CAP 

. 0 0 Mr u 

.42000 

. 06 U 00 

53 

Cfi07 



2CAP 

. 02*0U 

1.50000 

.50000 

54 

CSR13 



2CAH 

.0060U 

.42000 

. 479on 

55 

CU13 



2CAP 

. IJZ*00 

1.31000 

.65UOO 

56 

150D 



2CAP 

.00300 

.15000 

. U4S00 

57 

151D 



2CAP 

.00300 

.15000 

• 2500U 

58 

MS39006 



2CaP 

.02400 

4.00000 

1.50UOO 

59 

1U034012 



2CaP 

. 04000 

8.00000 

B.OOOOO 

60 

1U031474- 

1.14 


2CAP 

.02400 

2.44000 

.20UOO 

61 

PRbCESSOR 

(MED) 

-OCAKD 

4.500003000 .00000 

21 .60UOO 

62 

SN5400 

IC 


14 

, 03000 

2.10000 

.54UOO 

63 

SM5401 

IC 


.14 

.03000 

2.10000 

.54UQ0 

64 

SNi5402 

IC 


14 

. 03000 

2:10000 

.54U00 

65 

SN5403 

IC 


14 

• 03000 

2.10000 

.54000 

66 

SN5404 

IC 


14 

. 03000 

2.65000 

.54000 

67 

SN5406 

IC 


14 

• 03000 

2.65000 

.54000 

68 

SN5410 

IC 


14 

• 03000 

2.10000 

.54000 

69 

SN5420 

IC 


14 

• 03000 

2:10000 

.54000 

70 

SN5426 

IC 


14 

• 03000 

2.83000 

.54000 

71 

5N5442 

It 


14 

. 04000 

13.00000 

.54000 

72 

SN5473 

IC 


14 

,04000 

2.75000 

.54000 

73 

SN5475 

IC 


14 

• 04000 

4,21000 

.54000 

74 

SN5493 

IC 


14 

• 04000 

4:72000 

.54000 

75 

SN5495 

IC 


14 

• 03000 

11.00000 

.54000 

76 

SN54107 

IC 


14 ' 

• 030Q0 

3:89000 

.54000 

77 

SN54122 

IC 


14 

• 03000 

5.69000 

.54000 

78 

SN54153 

IC 


14 

, 04000 

5.47000 

.54000 

79, 

SN54155 

IC 


14 

• 04000 

7.02000 

.54000 

80 

SN54174 

IC 


14 

• 04000 

7.95000 

.54000 

81 

3N54ia0 

IC 


14 

• 04000 

18.80000 

.54000 

82 

Srv54198 

IC 


14 

, 04000 

14:29000 

.54000 

83 

SM55109 

IC 


14 

, 04000 

6.15000 

.54000 

84 

5^8266 

IC 


14 

• 04000 

7:45000 

. 54U00 

05 

58H90 

IC 


14 

• 04000 

4.42000 

.54000 

06 

DG506 

IC 


14 

. 04000 

60 .00000 

1.26000 

87 

8T8Ur 

IC 


14 

, 04000 

28:00000 

.54000 

80 

0T9U 

IC 


14 

. 04000 

28.00000 

. .54000 

89 

KM5305 


IC 

14PR0M 

, 04000 

60 . 00000 

.54000 

9h 

IM6523 


IC 

14HAM 

, 04000 

35.00000 

.54000 

91 

HUI-6600- 

2 

IC 

14 

• 04000 

1.3.60 000 

.54000 

92. 

DG508 8 

INPUT 

14r1ULTPLtX 

. 04000 

32:00000 

1.28000 

93 

10030697 



eXFORi^EW 

.14500 

46.45000 

0.00000 

94 

1U030771 



6XrORMEH 

.01000 

6.00000 

.25000 

95 

24E26CT 



6XF0RhEK 

. 10000 

20.30000 

0.00000 

96 

RELAY 



6 

. 04000 

4.10000 

0.00000 

97 

E^!I F ILTER 


2 

• 01800 

4.44000 

0.00000 

98 

PROCESSOR 

CARD 

-0 

3. 0000U1354 .00000 

21.60000 

99S0LDER CONNECT 


-0 

. OOCOl 

0.00000 

0.00000 





-0 

-0,00000 

- 0 : 00000 

-0.00000 


Figure 129. - Concluded 


SECTION 8 

OPERATIONAL MODEL 


To complete the required life-cycle cost study, a model was developed 
to depict the operational environment. This included route structure, aver- 
age flight times, total operating time, maintenance facilities, test and repair 
philosophy, and other factors associated with daily airline operation. 

The following subsections describe the operational model and the data 
used as inputs to the support and operational cost tradeoff studies. The 
sources of the model included the airframe and airline ATT study results, 
present procedures used for the DC-10, and projected changes in the environ- 
ment for the 1980 time period. 

A single route was used, since it was felt that an average operational 
time based on intercity distances would be an adequate tradeoff base for the 
flight control system. 

Most of the data supplied was used as input to the GEMM (Generalized 
Electronics Maintenance Model) program. This is an Army-developed, life- 
cycle cost program which was used to provide support cost analysis for the 
ATT study. The program is briefly described in Appendix A. 


Operational Characteristics 

The following operational characteristics were used in the study: 

• Average flight length of 1. 6 hours plus 0. 2 hour of ground operation 
from engine start to takeoff decision speed and 0. 2 hour of ground 
operation from touchdown to engine shutdown. A 0. 4-hour through- 
stop time was assumed. Figure 130 shows a typical flight profile. 

• Average of five flights per day 
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SEGMENT "A" - INCLUDES ENGINE START. TAXI AND PRE-TAKEOFF CHECKS, LINEUP 
AND TAKEOFF TO DECISION SPEED. 

SEGMENT ”B" - INCLUDES A 20 MINUTE THRU-STOP OR A 30 MINUTE TURN-AROUND. 


Figure 130. - Operational Flight Profile 


• A maximum capacity of 200 passengers per flight a 

• A fleet of 200 aircraft 

• An average of 14 operating hours per day. 

• An average time between major scheduled stops with depot or main- 
base repair capability of 8 hovirs. This was based on the. assumption 
that, out of the 48 cities in the route structure of Figure 131, 25 per- 
cent will have turnaround station, or well-stocked line station capa- 
bility, This amounts to 12 stations where LRU replacement can be 
obtained. The other 75 percent of the stations are called through 
stations and are assumed to have no repair capability. In other-words, 
if a system sustains a first failure at or enroute to some station 
where repair is not available, it must be capable of continuing on the 
designated route on the strength of the redundant systems until a 
repair station is reached. This philosophy is based on the assumption 
that the logistics costs for the support of a complex system which is 
essential to the aircraft operation would be prohibitive if every landing 
site had even minimum system-repair capability. It was also assumed 
that the airline schedules allow the one stop at a repair facility in each 
8-hour time period. 

• An economic life of the equipment of 15 years. 


Maintenance Support Assumptions 

The maintenance facilities and general support assumptions used in 
the study are described in the following paragraphs. 

Maintenance shop capabilities. - It was assumed that four levels of 

j , ' .. .. 

repair are utilized as shown in the diagram of Figure 132. The’^first" of these 
is a major LRU replacement capability at selected scheduled stops called 
line stations. That is, items of control hardware essential to continuation of 
the flights are available as stockage. 
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46* 

1 Boston 8 Rochester 

2 Hartford 9 Buffalo 

3 New York 10 Pittsburgh 

4 Philadelphia 11 Cleveland 

5 Baltimore 12 Columbus 

6 Washington 13. Dayton 

7 Syracuse 14 Cincinnati 


15 Detroit 22 Norfolk 

16 Indianapolis 23 Charlotte 

17 Chicago 24 Atlanta 

18 Milwaukee 25 Tampa 

19 Minneapolis 26 West Palm Beach 

20 St. Louis 27 Miami 

21 Kansas City 28 New Orleans 


29 Houston 36 Sacramento 

30 Dallas 37 San Francisco 

31 San Antonio 38 Los Angeles 

32 Denver 39 San Diego 

33 Phoenix 40 Spokane 

34 Las Vegas 41 Seattle 

35 Reno 42 Portland 


43 Anchorage 

44 LIhiie 

45 Honolulu 

46 Hilo 

47 Salt Lake City 

48 Albuquerque 


Figure 131. - Route Structure 



SUB- 

- ASSEMBLY 
TESTS GOOD 



SUB-SliB- 
ASSEMBIY 
TESTS GOOD 



Figure 132. - Maintenance Flow Diagram 
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The repair process at the line-station level consists of employing the 
built-in test equipment to isolate the fault to the LRU level. This identifi- 
cation is assumed to be 95 percent effective for digital equipment and 75 
percent effective for purely analog gear. 

Two choices are then available. The faulty LRU may be replaced, the 
system retested, and operation continued, or the replacement may be deferred 
if the fault is noncritical (leaving the system fail-operational) and no replace- 
ment exists. The deferral may continue until a stop where a greater replace- 
ment capability exists (a turnaround station) or until a failure occurs which 
does not leave a fail- operational capability. As mentioned above, at least 12 
scheduled stops were assumed to have LRU replacement capability. This was 
a sensitivity variable in the cost analysis. The turnaround station was con- 
sidered to be the second level of maintenance. It was assumed that this shop 
capability was available for 16 hours a day, seven days per week. 

The third level of maintenance support exists at a well-equipped turn- 
around station or the main base and consists of a module or card replacement 
capability where a failure is detected by automated test equipment. This 
card or module is pulled from the LRU, replaced with a functioning item 
from stock and the LRU retested. The failed item is then either sent to the 
fourth level or thrown away, depending on its cost. 

The fourth level is a piece-part replacement capability which exists in 
the same facility and, in fact, utilizes the same test equipment as the third 
level through the use of special adaptors (as shown in Table 25) for the cards 
and modules. Tests using standard laboratory equipment such as meters, 
oscilloscopes are also completed. Once the failed part is identified, the 
module is given to a technician for removal and replacement with a functioning 
part. 


It was assumed that four shops existed which could perform the third 
and fourth level of maintenance and that these shops operate 8 hours per day, 
seven days per week. 
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TABLE 25. - MAJOR GSE COMPONENT LISTING (example) 


■ 

AT HONEYWELL ' 

AT MDC 

Tot«l 

Qty. 

D «iE 
Lab 

Prod. - 
AFS 

Prod. 

Roseville 

Aero 

School 

Sein^ice 

Center 

UG2297AA01 Automatic 
Interface Station 






B 

UG2304AA01 Manual 
Interface Station 



© 


© . 

B 

UG2303AA01 Instrument Bay 

8 

isa 

© 


© 


UG2296AA01 Computer and 
Measurement Console 






B 

UG2295AA01 Central 
Computer Station 


1 



' 


UG2301AA01 Disc Memory 


r 




1 

UG2321AA01 System 
Mockup Bench 

2 




© 

2 

UG2320AA01 FEB Adapters, 
Set of 23 


1 




1 

UG2318AA01 Card Adapters, 
Set of 54 

2 

© 



© . 

2 

UG2319AA01 Adapter - 
BG1034 Computer 

. 3 

© 



© 

3 

UG2319AB01 Adapter - 
BG1035 Computer 

3 

© 



© - 

. 3 

UG2319AC01 Adapter - 
BG1036 Computer 

3 

© 



© 

3 

UG2319AD01 Adapter - 
BGl 037 C ompute r 


© 


■ 

© , 

3 

UG2319AE01 Adapter - 
CG1022 Panel 

2 

. 

© 


© 

2 

UG2319AF01 Adapter • 
LG1024 Transducer 

1 

© , 



1 

2 

UG2319AG01 Adapter - 
CG1023 Panel 

2 


© 


© 

2' 

UG2319AH01 Adapter - 
CGI 02 5 Panel 

2 


© 


© 

2 

UG2319AI01 Adapter - 
CG1025 Panel 

2 


© 

1 


© 

2 

UG2319AJ01 Adapter - 
CG1026 Panel 

2 


© ■ 


©, 

2 

UG2319AK01 Adapter - 
LG1025 Sensor 

1 

© 



1 

2 

UG2319AL01 Adapter - 

GG1016/GG1017 Accelerometer 

1 

© 



1 • 

2 

UG2319AM0I Adapter - 
GG1018 Gyro 

I 

© 



1 

1 

2 

UG2322AA01 Test Set - 
Burn-In 


1 

1 

1 



1 ■■ 1- 

DIT-M-CO Adapter 


1 

! 


i..„ - 

j 1 

Special Maintenance Tools - Set 

1 







1 Indicates number of items required but available — ^ rates thru ll /month 

for transfer from D&E Lab quantity 

Qtv for rates over 11 /month 

Available from current programs 


























































Maintenance manpower. - Two skill levels were used for all mainte- 
nance actions. While there may be a greater number of skill levels involved, 
it was felt that two would give a sufficiently wide salary spread for the assum- 
ed repair actions. The tasks assigned are summarized as follows: 

• Skill Level 1 - 

- Equipment checkout using BITE 

- LRU removal and replacement 

- Selected LRU test 

- Failed part removal and replacement 

• Skill Level 2 - 

- Complex LRU test and module replacement 

- Module-and card-level testing and failed-part identification 

- Hydraulic component test and failed-part identification 

A productivity factor of 75 percent was applied to the maintenance 
personnel, such that 6 hours of an 8-hour work period are productive hours 
when maintenance and repair work are actually being accomplished. 

The cost to train each skill level was placed at $1000. This was based 
on salary and overhead for a 2-1/2 to 3-week training period for an exper- 
ienced technician. A retraining period of every 2. 5 years was applied. 

The salaries for each skill level are: 

• Level 1. $8 500 /year 

• Level 2. $12 500 /year 

Test equipment . - Beside the BIT equipment, three basic types of 
test equipment were defined. The first of these is an automated device used 
for the LRU and module testing and subsequent fault isolation. The necessary 
adapters are assumed to be part of the equipment. The cost of this equip- 
ment was placed at $100 000 per unit. 
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The second type of equipment is a manual set used for general check- 
out of hydraulic equipment including pumps and servo actuators. Loose ' 
meters, scopes and other small items of equipment are lumped in this cate- 
gory. This equipment is assumed to cost $40,000 per group., .. 

The third type is a specialized piece of equipment for testing of rate’ 
gyros and is assumed to cost $20,000. 

Stockage levels. — Required stockage was broken into two major 
groups — initial provisioning stock and reorder stock. Initial provisioning 
stock consists of nonrepairable stock and repairable stock (i. e. , that stock 
which is not classed as "throwaway"). 

Nonrepairable stockage includes three classes of items: 

• Initial-issue quantity — This hardware is placed in the field con- 
currently with the introduction of the sy^em. 

• Order-ship quantity -- This is the stockage necessary to .fill the • 

stockage pipelines and is based on the component turnaround time. 

• Replacement quantity — This is the nonrepairable stock located at 

the depot that is used for backup and replacement as equipment is used. 

For repairable stockage, there is no need for initial-issue stockage or 
replacement stockage since the item is not lost to the system except through 
attrition; Stockage required for repairable items would be similar to order- 
ship stock to fill the pipeline while repair is being implemented. 

Reorder stock is based on the equipment MTBFs and is the replace- 
ment quantities used during the life of the systems. Stockage is based on the 
MTBF associated with the various components, modules and parts. In addi- 
tion, operating time, repair times, checkout times, turnaround times, and 
order-ship times are used. Furthermore, a safety factor was applied in the 
form of confidence levels of the normal statistical distribution which was one 
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of the cost variables in a portion of the study. The nominal value is 1. 65 
times the standard deviation, or a 95 percent confidence level. 

Publication cost . - The publications associated with the flight control 
system operation and repair covered the operation of the test equipment and 
description of repair procedures. The following cost assumptions are 
applicable: 

Cost per page for any publication 
Number of pages for total system checkout 
Number of pages for isolation to component 
Number of pages for isolation to module 
Number of pages for isolation to part 

Transportation and requisition time between maintenance levels . - The 
cost of transporting various items of equipment from level to level was com- 
puted on the basis of equipment weight and a shipping cost per pound per mile 
of approximately $. 004. The time of transportation between the line and depot 
levels was assumed to be 12 hours. 

Requisition times for parts, modules and components from the depot 
level to the organizational level was assumed to be on the order of 8 hours, 
while requisitioning within a given depot was assumed to be less than 1. 0 
hour. - 

Waiting times for maintenance. - The time associated with the waiting 
period before maintenance begins is: 

Line and turnaround stations 0. 1 hr 

Turnaround station and main base ‘ , 

(modide replace) 120 hrs 

.C ■ ■ 

Turnaround station and main base 
(part release) 


$150 

50 

15 /component 
5 /module 


120 hrs 



The turnaround times for the various modules and components are 
computed as a function of transportation times, waiting times, probability of 
having spare parts on hand, and mean times to repair for the necessary module. 


Control Hardware Testing, Maintenance Assumptions and Requirements 

The flight equipment was sized to include BIT which was assumed,, to 
satisfy the fault-isolation requirements. This includes isolation of a faulty 
LRU with 95 percent accuracy (assuming digital equipment) and a faulty LRU , 
with an effectivity of 95 percent. Total checkout time at the system level ' 
using BIT equipment was assumed to be 0. 3 hour. 

j 

, - I 

The requirement concerning LRU fault isolation means that, given a | 
failure, the BIT equipment will indicate the faulty LRU 95 percent of the time. | 
The capability of correcting a fa\ilty LRU means that the LRU which is sub- | 
stituted for the faulty LRU will not exhibit the same failure for a period of at 
least 10 days. The failure rate of the BIT equipment was lumped with the 
flight control equipment. 

Off-aircraft maintenance assumptions indicate that; (1) replacement 
of the indicated failed module will produce a functioning LRU in 95 percent of 
all cases, (2) replacement of the indicated failed piece parts will result in a 
working module in 95 percent of all cases, and (3) tests performed on all 
modules will assure that the LRUs which utilize the modules will test within 
specification limits in 99 percent of all cases. These figures are an indica- 
tion of the repair efficiency. 

Mean time to test, replace and repair faulty LRUs on the aircraft are 
summarized in Table 26 for typical electronic equipment!. Hydraulic equip- 
ment in the form of actuators may vary from 0. 5 to 1. 0 hour. ‘ "Off-aircraft 
mean time to repair estimates for various types of components are: 
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TABLE 26. - PRELIMINARY QUANTITATIVE ON-AIRCRAFT 
MAINTAINABILITY DATA 




Flight line maintenance level 


Restorative 

Maintenance 

Personnel | 

Line -replaceable unit 

maintenance 

task 

description 

.manhours 
per task 
(MMH) 

Number 

Skill 

level 

Computer unit 

Test 

0 . 030 

1 

Basic 

Remove and replace 

0. 065 

1 

Basic 


LRU 

Checkout 

0. 030 

1 

Basic 

Rate gyro assembly 

Test 

0.030 

1 

> Basic 


Remove and replace 

0.100 

1 

Basic 


gyro assembly 
Checkout 

0. 030 

1 

Basic 

Linear accelerometer 

Test 

0.030 

1 

Basic 

assembly 

Remove and replace 

0.030 

1 

, Basic 

■ , ' 

accel assembly 
Checkout 

0. 030 

1 

Basic 

Control wheel sensor 

Test 

0.030 

1 

Basic 


' Remove and replace 

0. 165 

1 

Basic 


LRU' 

Checkout = 

0.030 

1 

Basic 

Panel (contains replace- 
able modules) 

Pitch coarse select 
control module 

Flight director 
' control module ' 

Directional guidance 

Test , ‘ ‘ 

0. 030 

1 

Basic 

control module 

Remove and replace 

0,120 

1 

Basic 


LRU 

Checkout 

0. 030 ' 

1 

Basic 

Pitch guidance 





control module 

Autothrottle control 
module 






Note: Since only one person is required per task, MMH per task equals elapsed time. 

Mean time to repair (MTTR) = 2 * ^ 5 ^ 4 ^ 0. 132 hours = 7. 9 minutes 

Maximupa- predicted repair time for^ 90 percent of on-aircraft tasks = 2 MTTR,= 15.8 minutes 
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Flight controller panel 

0. 625 

hr 

- 3 . 

Mode select panel 

0. 675 

hr 

• 3 ." 

Altitude and airspeed mode control panel 

0. 625 

hr 


Computers 

0. 75 

hr 


Gyro package (three elements) 

0. 75 

hr 


Hydraulic servo single- surface actuator 

7.0 

hrs' ' 


Dual tandem surface actuator ' 

10. 0 

hrs 

•“ ■ ■ .• 

Cabling 

7.6 

hrs 


Single driver actuator 

6.0 

hrs • 


Single integrated power actuator 

7;0 

hrs ■ 

1 

Control wheel sensing 

0.4 

hr 



These times are assumed to include fault diagnosis, replacement time, 
retest and recalibration. The individual modules making up the component 
are each assumed to have repair tirties commensurate with the type of module, ' 
i. e. , electronic board 1.4 hours, accelerometer 10.0 hours, panel modules 
0. 6 to 1. 2 hours and individual gyro, 11. 8 hours. 

Section 3 specified the overall system requirements for maintainability. 
In summary, they are; 

• Unscheduled aircraft maintenance rate of 0. 02 MMH/FH. 

• Scheduled maintenance periods at greater than 300 hour intervals, 
if necessary. 

• Off-aircraft repair time per failure of 5. 35 hours, 

• An on- aircraft repair time per failure of 0. 143 hour excluding 
hydraulic elements. 

• Mean time to check out equipment on aircraft of 0. 30 hour j 

The piece parts utilized in the study were assigned two levels of fail- 
ure rates to determine the effect on mean time to first failure and total system 
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repair costs. This was done for one of the final system candidates. If over- 
haul was required, the costs were included and the improved failure rate 

utilized. . 

i 

Obviously, as redundancy is increased, the total number of parts 
increases, and the probability of experiencing a part failure increases. If the 
assumption is made that maintenance must be performed at the time the failure 
occurs, maintenance costs would grow unnecessarily. Consequently, some 
deferral assumptions were made. A discussion of this and the effects on cost 
and "dispatch reliability” appears later in this section. 

Some consideration was made of "throwaway" maintenance concepts. 
The basis of the evaluation was a comparison of the cost of a new module, 
compared to the cost of fixing the failed unit. The GEMM program has the 
capability of considering this type of maintenance as one of many alternates. 


System Reliability Considerations 
The reliability goal for the system was established in the range of 

-7 

1 X 10 failure per flight hour based on an 8-hour operational interval. In 
addition, a scheduled maintenance period was established at 300-hour inter- 
vals or greater, if it is necessary. The existence of a scheduled maintenance 
period was included in the reliability analysis since it affects the overall sys- 
tem MTBF. ■ ■ 

It was assumed that the maintenance or overhaul actions performed 
during these scheduled maintenance periods bring the system to "like-new" 
condition. In addition, it was assumed that replacement upon failure and sub- 
sequent successful system checkout yields "like-new" condition. These 
assumptions are' implicit in the use of the exponential failure rate which shows 
no wear-out characteristics. Some preliminary electronic part failure rates 
are shown in Table 27. ' , 
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TABLE 27. - HONEYWELL PIEGE-PART FAILURE RATES 


Part • 

F ailure rate 
(percent per 
1000 hours) 

Capacitor, fixed, ceramic 


Capacitor, fixed, electrolytic -TA, foil 


Capacitor, fixed, electrolytic-TA, solid 


Capacitor, fixed, electrolytic-TA, wet-slug 

0. 043 

Capacitor, fixed, glass dielectric 


Capacitor, fixed, metallized paper dielectric 

0. 014 

Capacitor, fixed, mica dielectric 

0. 003 

Capacitor, fixed, paper dielectric : 

0.010 

Capacitor, fixed, plastic dielectric 

0. 020 

Gear train, no load, per mesh 

0. 022 =5= 

Gear train, loaded, per mesh 

0. 054 * 

Integrated circuit, analog or digital 

0. 01 

Motor 

0. 720 * 

Reactor 

0,013 

Relay armature, general-purpose, per coil 

0. 116 ■ 

Plus, per contact pair, % per 1000 on/off cycles 

0. 026 

Resistor, fixed, composition 

0.001 

Resistor, fixed; film 

0. 005 

Resistor, fixed, wirewound 

. 0. 010 

Resistor, thermal 

0. 006 

Resistor, variable 

0. 080 

Diode, controlled rectifier 

0. 154 

Diode, silicon 

. 0.009 

Diode, voltage reference 

0.016 

Diode, voltage regulator 

0.016 

Diode, switching 

0. 009 

Diode, tunnel 

0. 095 


* These failure rates assume scheduled maintenance 
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I TABLE 27. — HONEYWELL PIECE-PART FAILURE RATES - Concluded 


- Part • 

Failure rate 
(percent per 
1000 hours) 

' Diode; stabist or 

0.011 

Diode, dual 

0. 015 

Diode, quad 

0. 022 

Diode, photo 

0.180 

Switch, rotary 

0.117 

Switch, sensitive 

0. 099 

Switch, thermostatic 

0.218 

Switch, toggle 

0.187 

Synchro, control transformer 

0. 263 * 

Transformer, 1-watt or more 

0.145 

Transformer, less than 1-watt 

0.084 

Transistor, field-effect 

0. 015 

Transistor, silicon, dual 

0.078 

Transistor, silicon, general-purpose 

0.013 

Transistor, silicon, power 

0. 071 

Gyro, GNAT 

10.0 * 

Accelerometer 

5. 0 * 

Laser gyro 

3. 3 * 

MHD gyro 

4.0 * 

Single-surface actuator . 

, ;1 . 0 

Single-driver actuator 

1. 54 . * 

Single- channel integrated power 

1.33 =!= 

actuator 



* These failure rates assume a scheduled maintenance 
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Operational reliability . - System reliability was computed in terms of 

the system probability of failure for each of the system configurations studied. 

» 

This allowed a direct comparison of each configuration's reliability against ; 

-7 

the reliability goal of 1 x 10 failure per flight hour. For the purposes of 
this study, an operating time of 8 hours was used in the reliability calculations 
to represent the approximate operating time of a commercial aircraft between 
stations with repair capability. 

Reliability success path block diagrams were drawn for each of the ' 
systems studied (see Section 7) where each block represents a major flight ' 
control function. The diagrams show the level of redundancy employed for 
each function, if any, and note the necessary number of channels that must 
operate for system success, depending on the type of redundancy monitoring 
employed. 

Failure rates in percent per 1000 hours were assigned to each block 
as determined by the GEMM program employed in this study. These failure 
rates were derived from Honeywell standard piece-part failure rates and com- 
mercial airline operational data. 

A probability of failure was calculated for each redundant function 

N 

configuration based on the binomial expansion formula of (R+Q) which 
assumes an exponential failure distribution where R=e and Q=l-R. A total 
system probability of failure (Q) was then determined by summing the subse- 
quent series strings of failure probabilities. This could be done because, for 
small probabilities of failures, Q = t. Therefore, Qtotal”^^ ^2^ ^3 ^* * * ^n^^ 
or in this case, + X 2 ^ X 3 ^ + • • • Xn^‘ 

The advantage of this approach to reliability prediction, where small 
failure probabilities are encountered, is that the reliability of a system is 
based on the summation of what are essentially failure rates rather than the 
product of a series often or more 9's behind the decimal point. Also, the 
relative contribution of each function to the system reliability can readily be 
seen when expressed in terms of negative powers of ten (Q). 
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. . The probability of failure per flight hour over the 8-hour period was 

calcxilated as 1/8 of the system probability of failure for 8 hours. 

Component reliability . - Since certain of the system elements are sub- 
ject to wearout, the resulting required maintenance action has a direct bearing 
fin system reliability and maintenance costs., particularly since many of. these 
elements may be present due to redundancy. These elements are the hydraulic 
actuators and gyro elements. The electronic components were assumed to 
have only random failure characteristics. The overhaul intervals for these 
wearout items were obtained from actual suppliers. 

Costs w;ere also obtained and, with the time interval, formed an input 
to the .GEMM program included in the total life-cost evaluation. The indi- 
vidual reliability figures used reflected the overhaul action. The values 
used were; 

Repair 

Item Cost Time Interval 

Actuators $ 80 7. 0 hrs 1500 hrs 

Gyros $1827 11. 8 hrs 2500 hrs 

Repair, and fault isolation efficiency . - It was assumed that, the require- 
ments for LRU fault -isolation and fault- correction effectively could be handled 
as nonperfect repair. An incremental failure rate factor, which is the ratio 
of total repair actions to the number of good repair actions, was applied; the 
equation for failure rate then became . . 

g 

where 

N = number of components 
g = exponential failure rate 
n = total repair actions 
Ug = total successful repair actions 


291 



The equation may be rewritten as 

, _ NX 


ng/n 


where n /n becomes a "repair efficiency". This could then be related to the 

o 

fault isolation and repair effectivity. This relationship was assumed as 
follows; 


ng/n = 




where 


Nj = LRU fault isolation accuracy (95%/ 100) 
= LRU repair effectivity (95%/ 100) 


The new X could now be utilized in the system in a manner similar to 
the normal exponential failure rates. This X - affected both system reliability 

3 

and maintenance costs as determined by the GEMM program. 


Initial Costs 


Three major cost areas were considered. Support costs are those 
which encur to the owner in the operation of the system, and they were in part 
computed by the GEMM program. The other two cost items are production 
costs and research and development which were broken down in the following 
manner. . ■ . . ... .... - 


- Research and development. - The elements of the R and D. costs . are: 

• Design and development 

Preliminary analysis 
System mechanization and specs 
Detail design 
Layout and drawing 
Structural analysis 
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Thermal analysis 
Travel 

Engineering material purchase 
Administration 
- ■ Lab testing 

• Reliability requirements and analysis 

• Quality assurance 

• Maintainability 

• In-plant test equipment and facilities 

• Data preparation and transmittal 

• Vendor support 

. Production. - The major items of. production cost are; - 

• Material purchase 

• Assembly 

• Inspection and quality control 

• Acceptance -testing 

• ' Packaging and shipping 

Many of these items remained fixed for each system considered in the 
trade study. Those items sensitive to system design were adjusted prior' to 
inclusion in the tabulation in the GEMM program. Piece -part costs are 
dependent on reliability levels, burn-in requirements,' avaUability, and 
handling. Complexity, number of parts, handling, and skill level required 
for assembly are some factors affecting the assembly costs. 
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Operations Costs Due to Delays, Diversions and Cancellations. . > 

■ : M 

A major item considered in the life-cycle cost analysis was that cost 
attributed to an out-of-service aircraft due to failures in the flight contrpl 
equipment. The dispatch philosophy adopted for the ATT Study provided, thatj, 
the aircraft may take off providing a further failure in a flight -critical system 
may be sustained ana still result m an operational capability.. 

With the above philosophy as a ground -rule, certain system mechani- 
zations are subject to high delay costs. This includes triple -redundant .sys- 
tems with comparison monitoring (since two of three channels niust operiite 
for proper system operation) and all dual- or single-thread systems. Quad- 
and higher-level redundancy satisfies the requirement, since two or more 
failures may be sustained and leave the system operational. In other words, 
an aircraft may be dispatched with one failure, since a second failure could 
be sustained while leaving an operational system. 

One class of triple-redundant systems also theoretically meets the 
above requirements. In-line monitoring of each channel allows two of the 
three channels to fail and leaves the third channel to complete the scheduled 
flight. Or, an aircraft could be dispatched with one failure. , There are, 
however, serious doubts concerning the capability of in-line, or "self"- 
monitoring to identify all failures. Opinion solicited from both airlines and 
airframe manufacturers reflect this concern. United Airlines, in the report 
summarizing their ATT work (ref. 3) specify quad, comparison -monitored 
techniques on their minimum equipment list. 

In applications where self -monitoring is applied to non -flight -critical 
elements, such as outerloop, or SAS computations where primary flight con- 
trol is mechanical, the confidence is sufficient. 

Where the primary flight control is fly-by-wire, a greater confidence 
level is necessary, and comparison monitoring techniques provide this level. 
Consequently, where utilization of in-line monitoring for triple systems was 
considered, a dispatch cost consistent with the triple, comparison nionitored 
systems was applied. 
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To derive equations that allowed a consistent application of dispatch 
costs to the various systems, the operational profile was re-examined. 
Figure 133 shows the profile; "A" represents that leg of the operation where 
maihit^nance is available. If a "dispatch”-type failure occurs somewhere in 
the Ih 2-hour span, a delay occurs since no maintenance is available. If the 
aircraft is in-flight, either a diversion occurs or the plane proceeds to its 
(fesi^ated terminal where it then becomes a delay or cancellation while 
waiting for the proper maintenance. 



Figure 133. - Daily Operational Profile 

Of the 11. 2 hours, 6.4 or 57 percent are flight hours, and 4. 8 or 
43 percent are on-ground hours. The inflight failures are, at worst, diver- 
sions, while those on the ground are either cancellations or delays. This 
categorization is a gross simplification of a problem which is unique with 
each failure, and an effort to obtain real cost information from airlines for 
these specific occurrences met with problems' oPdefinition. Consequently, 
for the study, data was obtained from reference which defined specific costs 
for the occurrence in question. These are 


Delays (1 to 3 hours) 

$1000 = Cqy 

Diversion 

$2750 = Cj^Y 

Cancellation 

$9000 = C^ 
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The probability of a failure occurring in a triple system which would 
cause it to be fail-catastrophic rather . than faU-operational is the probability 
of failure of one or more channels, or 


= 3(l-e + 3(l-e'^^*) e"^'^* + (l-e'^‘^b . 

^3 

where 

P = probability of failure of one or more channels 
^3 

Xc = failure rate of one channel 
t = assumed operations average time 


For a four-channel system, the following equation applies; 

P =6(l-e‘^^^) e "^^^ + 4 (1 + (1 - e 
^4 

where P„ = probability of failure of two or more channels. 

^4 


This assumes a four-channel comparison-monitored system where 
two channels may fail and still leave the system in a fail -operational state. 
The average time of 5.6 hours is assumed, since the failure may occur 
anywhere in the 11.2-hour operational period. 

As one further refinement, it was assumted that only a third of the 
on-ground failures would result in cancellations, the balance being delays. 
The total cost equation m;ay then be summarized as follows; 

Cp = (365 Prj.) [(. 57) + (^) (C^) + I {.43)Cj^y1 

Cp - [1. 15 X 10 ®]Py 

where Cp = $ /aircraft/yr 
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•' ‘ For a triple system, the equation yields a failure incidence per year 

of between 8 and 10; a quad system yields 0. 2 to 0. 4 incident per year. 

'The effects of the above costs are reflected in the tabulation in 


Section 10. 


SECTION 9 

OPTIMUM CONFIGURATION SELECTION. 


The groundrules for selecting the optimum configi;ration were well, 
defined by two sentences in the NASA contractual statement of work: 

• f ■ ■ . ’ 

■ • c 

"Flight safety and economic operation are required for the operational 
success of a flight control system. Therefore, reliability, maintainability 
and cost are primary factors in considering design alternatives. " 

A significant part of the effort on the study was, consequently, devoted 
to definition of a tradeoff methodology which would provide, a consistent means 
for evaluation and selection of the optimum configuration. This methodology, 
described more fully in Appendix A, is based on "life-cycle costs", required 
to meet the fundamental requirements of function, reliability and maintain- 
ability. By making all comparisons against a common element (cost), and 
without deviation from the . fundamental requirements, a truly unbiased trade- 
off is achieved. 


Life- Cycle Cost Determination 

The life-cycle cost determination integrates the effects of configuration 
size, complexity and reliability with an assumed route structure and mainte- 
nance philosophy. The latter two factors make up the operational model 
defined in Section 8. 

The actual computation of the life-cycle costs for each configuration 
was largely performed with the GEMM computer program described in 
Appendix A. . ^ 

The detailed electronics parts list was converted to modules which 
were assembled into standard ATR boxes. Gyro and accelerometer elements 
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were assembled as component packages^ and estimates were made for the 
interconnecting cabling, and cockpit panels and sensors. 

The data obtained from the above sizings included cost to the module 
level, or part level where applicable, mean time to repair estimates, number 
of parts per module, number of modules per component, weight, and module 
size. With the modules and components defined, the level of manpower skills, 
publications, and test equipment necessary to accomplish repair may be 
assigned. 


Other data used is outlined in Section 8. This includes items such as 
total operating hours, number of line and main-base stations, part reliability, 
waiting time for maintenance, and average intervals between stops with main- 
tenance capability. 

The predominant life-cycle cost is the replacement stock necessary 
due to failures and wearout; consequently, the item most affecting total cost 
is component MTBF. With the assumption of improved BIT due to digital 
computation and with the utilization of ATE, projected manpower costs re- 
duced significantly. 


Life-cycle cost contributions break down as follows: 


Design and development 
Production 
Stockage (material) 
Maintenance manpower 
Training 

Inventory management 
Transporation 
Publications 
Overhaul 

Operating dispatch costs 



Total support cost 
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Production Costs 


Evaluations of the cost trade study were accomplished through the use 
of comparison plots of the given system configurations. A common denomina- 
tor of system production cost was utilized to provide a continuous reference 
parameter. i- • 

Production costs were broken down into fhe following elements: 


• Electronics 

• Hydraulics 

• Gyros _ _ 

• Accelerometers 

• Miscellaneous 

The percentage contribution of each of these elements. 4 s shown in 
Figure 134 for the 24 configurations considered., „Using .system 13 as an 
example, the contribution of each.of.the elercients.to the total life-cycle cost 
were extracted from the GEMM .program .run and cornpared with the percen- 
tage breakdown of production costs. - This comparison is shown in Table 28. 

TABLE 28. - LIFE-CYCLE AND PRODUCTION 
COST COMPARISON 


Item 

Percent of . > 

Production Cost 

. ..Percent of 

Life-Cycle Cost 

Electronics 

58. 6 

33. 8 

Gyros 

.... ..... 6.1 ^ 

29,6 , 

Accelerometers 

4. 7 

11-7 

Hydraulics 

• 27. 4 . . .. 

, . 23.3 

Miscellaneous 

3.2 

... - . 1 , 6 .. 


100.0 

100.0 
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Figure 134. 



System Cost Breakdown 





Note from Table 30 that even though electronics is close to 59 percent 
of the production cost, it represents roughly 34 percent of the life-cycle cost. 
The opposite trend is true for gyros, which represent 6 percent of the pro- 
duction cost but close to 30 percent of the life-cycle cost. 

A breakdown of estimated dollar amount production costs by system 
element for all 24 system configurations studied is given in Table 29. 


Support Costs 

Support costs are normally shown in terms of dollars per flight hour. 
The items include everything except design, development and production costs. 
Besides the support elements previously listed under life-cycle costs, the 
estimated cost due to delay for each system has been added as described in 
the operational model discussion in Section 8. Figure 135 shows system 
support costs as a function of production costs based on the assumed average 
of 8 flight hours out of 14 operating hours per day, or a flight-hour-to-operat- 
ing-hour ratio of 1. 75. On the basis of support cost, configuration 13A is the 
minimum-cost system. 

To indicate the effects of the delay cost and the impact of the dispatch 
philosophy on triple-redundant systems, the costs are again compared in 
Figure 136 where all costs due to dispatch delays are removed. 


System Mean Time to Failure Incidents (MTBF) 

MTBF, in hours, defines the time between any failure in the system, 
and does not represent loss of function. It is computed by a sum of all part 
failure rates, then converted to hours. Figure 13 7 shows the MTBF for each 
system' again referenced to system production cost. The triple systems are 
clearly superior because of the lower total number of parts in each system. 
From system MTBF, mean time between unscheduled removals (MTBUR) may 
be computed by applying, in part, the probability of false no-go factor (i. e. , 
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TABLE 29. - PRODUCTION COST BREAKDOWN 


System 

type 

System 

no. 

System element costs ($) 

Total. K$ 

Elect. 

Hyd 

Gyro 

Accel 

Misc 


12 

169 626 

82 500 

17 875 

14 410 

8 922 

293. 5 


14 

173 526 

82 500 

17 875 

14 410 

8 922 

297. 2 


14A 

173 526 

82 500 

10 115 

14 410 

8 922 

289, 5 

Triple 

15 

178 526 

97 500 

17 875 

14 410 

8 922 

312. 2 


16 

173 526 

82 500 

13 120 

14 410 

8 922 

292. 5 


18 

184 363 

82 500 

17 875 

14 410 

9 039 

308. 2 


19 

169 626 

no 500 

17 875 

14 410 

8 922 

321. 3 


1 . 

264 814 

107 250 

21 800 

17 600 

11 154 

422. 6 


3 

265 438 

130 000 

21 800 

17 600 

5 000 

443. 2 


4 

227 914 

97 500 

24 000 

14 800 

10 600 

374. 8 


5 

220 098 

107 250 

21 800 

17 600 

11 154 

381. 1 


6 

227 914 

130 000 

21 800 

17 600 

11 154 

408. 5 


7 

227 914 

97. 500 

21 800 

17 600 

10 600 

376.0 


7A 

227 .914 

97 500 

45 000 

17 600 

10 600 

399. 2 

Quad 

8 

211 438 

130 000 

21 800 

17 600 

11 154 

392. 0 


9 

207 746 

130 000 

21 800 

17 600 

11 154 

388. 3 


9A 

207 746 

130 000 

45 000 

17 600 

11 154 

411. 5 


10 

207 746 

98 875 

21 800 

17 600 

11 154 

354. 2 


11 

207 746 

130 000 

14 710 

17 600 

11 154 

381. 2 


13 

211 438 

97 500 

21 800 

17 600 

10 600 

358. 9 


13A 

211 438 

97 500 

15 300 

14 800 

10 600 

352. 4 


17 

227 914 

107 250 

21 800 

17 600 

11 154 

385. 7 

Trip-dual 

20^" 

184 363 

84 500 

17 875 

14 410 

9 039 

310. 2 

Quint 

2 

283 006 

97 500 

27 250 

22 000 

13 850 

443. 6 
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Figure 137. - Mean Time Between Failure Incidents 
Including False No-Go's 



the number of times a part is removed when in fact, no failure has occurred). 
This constant has been established at 0, 95. Another component of MTBUR is 
the probability of the repaired item not having to be returned within a short 
time for the same failure. This constant is also 0. 95. The probability of a 
system failure indication due to faulty built-in test equipment was established 
at 0. 99. Combining these constants yields approximately 0. 9 as a constant 
multiplying factor on MTBF to yield MTBUR, 

System MTBF is computed from part failure rates and is an output of 
the GEMM program. The component MTBF values generated are then used in 
the system process diagrams to compute operational reliability. The success 
diagrams and the resulting system reliabilities are given for each configura- 
tion in Section 7. A summary plot is shown in Figure 138. 

-7 

Seven of the candidate configurations fall above the 1x10 limit. 

However, systems 4 and 7 are extremely close, and all but system 16 are 

-7 

within a reasonable range of 1 x 10 failures per flight hour. 

System 16 is identical to system 14 with the exception of the pentad 
gyro configuration, which obviously has a significant deteriorating effect on 
system reliability. 


System Maintenance Manhours and Test Equipment 

The second major requirement of the system following operational 
reliability was a maintenance-manhour-to-flight-hour ratio of 0. 02. This 
ratio is very sensitive to flight hours assumed as well as to the ratio of 
operating hours to flight hours. 

For each system, maintenance manhours were computed as a function 
of the system MTBF, MTBUR, and mean-time-to-repair estimates at each 
repair level. Figure 139 is a plot of on-aircraft manhours for each system, 
while Figure 140 is the equivalent off-aircraft estimate. 
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Figure 138. - Operational Reliability versus 
Production Cost 
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On-aircraft maintenance times are roughly proportional to the actuator 
type and configuration employed. Off-aircraft times reflect gyro and elec- 
tronics repair times unless the driver-power actuator combination is used. 
The repair decision portion of the GEMM program indicated that the cheaper 
policy would be to repair the driver portions on-site, rather than sending 
them back for repair at the manufacturer, or other repair facility. All other 
actuators were repaired or replaced off-site; consequently, the maintenance 
is tabulated as a portion of the dollar cost for support rather than in the total 
manpower requirements. 

When each of these values is ratioed to the total flight hours, the plot 
of Figure 141 is obtained. The on- aircraft ratio is plotted against the off- 
aircraft ratio, and the line representing the maximum acceptable ratio is 
given. This line is dependent on the operating-hour-to-flight-hour ratio 
assumed and represents the sum of the on-and off-aircraft values. For the 
1. 75 ratio used in this study, based on 14 operating hours, system 13A has a 
total MMH/FH ratio of . 0289. When the DC-10 goal of 1. 25 is utilized (based 
on 14 operating hours), the MMH/FH ratio drops to . 0206, or close to the 
desired value, as shown in Figure 141. The DC- 10 goal is realistic for the 
ATT, and, as such, system 13A complies with the requirements. Any opera- 
ting-to-flight-hour ratio may be observed, since maintenance manhours were 
computed on the basis of 14 operating hours. 

A scheduled maintenance interval of greater than 300 hours was im- 
posed. For any system studied, the actuators required a scheduled mainte- 
nance interval of approximately 1500 hours and the conventional gyros 2400 
hours. Costs due to the overhaul actions were estimated and included in each 
GEMM run. The total overhaul costs were less than 0. 2 percent of the life- 
cycle costs. 

Test equipment costs were also included and were dominated by the 
ATE equipment. One complete test set appears at each main-base-level 
repair facility, and the full price was assessed even though 100 percent 
utilization of the equipment is not achieved. The contribution to total life- 
cycle cost was less than 0. 3 percent for all systems considered. 
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System Weight 


The approximate weight for each system is shown in Figure 142. The 
spread is primarily sensitive to whether the configuration is quad or triple and 
to the actuator configuration. A weight breakdown for each system is given in 
Table 30. 

Summary 

Table 31 summarizes the pertinent data developed in the trade study 
and life-cycle cost analyses for all 24 candidate configurations. Analysis of 
this data during the tradeoff revealed that configuration 13 was one of the 
better systems and that application of a hexad sensor array should result in 
a further improvement in life-cycle costs. 

Figure 143 shows the trend of life-cycle costs for each of the configura- 
tions considered. It is apparent, that configuration 13A, a digital, quad- 
redundant system, provides the minimum life-cycle cost, and, since it satis- 
fies the system requirements, it is the recommended configuration. 

A comparison of system 13A with other top candidates is shown in 
Figure 144. Included are analog quad (system,!) and triple digital (system 14) 
configurations; all have conventional sensors rather than laser or MHD devices. 

A breakdown of system 13A life-cycle costs by element is shown in 
Table 32 . Table 33 is a total cost summary for system 13A. 

With reference to the support cost indicated in Table 33 it is useful at 
this point to compare costs projected by reference-^2. Based on Chapters 22 
and 27, AT A equipment definitions, arid an extrapolation from DC -8 experi- 
ence, UAL has estimated a cost of $6. 75 per flight hour based on 10 flight 
hours per day. When referenced to 8 flight hours per day this figure becomes 
$9.45. Table 35 indicates a cost of $12. 85 per flight hour. Since the UAL 
estimate was direct maintenance cost, the comparable system 13A figure 
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TABLE 30. - SYSTEM WEIGHT BREAKDOWN 


System 

type 

System 

no. 

System element 

Total 

Elec. 

Hyd. 

Gyro 

AcceL 

Misc. 


12 

117. 1 

462 

15 

9.4 

305. 4 

900. 1 


14 

129. 7 

462 

15 

9.4 

305.4 

912. 7 


14A 

129. 7 

462 

6. 5 

9.4 

305. 4 

913. 2 

Triple 

15 . 

129. 7 

546 

12 

9 

303. 6 

996. 7 


16 

129. 7 

462 

11 

9.4 

305.4 

917. 7 


18 

146 

462 

15 

9.4 

309.4 

944. 0 


19 

117. 1 

546 

15 

9. 4 

305. 4 

993. 1 


1 

253. 9 

416 

19 

15 

401 

1260.9 


3 

174. 7 

728 

19 

15 

88 

1024. 7 


4 

165. 5 

546 

48. 2 

13 

395 

1113. 7 


5 

148. 3 

416 

19 

15 

401 

1155. 3 


6 

165.5 

728 

19 

15 

401 

1334. 5 


7 

165. 5 

546 

19 

15 

341 

1092. 5 


7A 

156. 3 

546 

140 

1 h 

341 

1213.5 

Quad 

8 

153. 1 

728 

19 1 

wm 

401 

1317. 7 


9 

155. 5 

728 

19 

15 

401 

1318. 5 


9A 

155. 5 

728 

140 

15 

401 

1439. 5 


10 

155. 5 

728 

19 

15 

401 

1084. 5 


11 

155. 5 

728 

10 

15 

401 

1309. 5 


13 

153. 1 

546 ' 

19 

15 

341 

1075. 7 


13A 

153. 1 

546 

13 1 

11 

341 

1069. 7 


17 

165. 5 

416 

19 

15 

401 

1178. 5 

Trip-dual 

20 

146 

377 

D 

9 

309,4 

859, 0 

Quint 

2 

215. 5 

546 

25 

20 

462 

1268. 5 
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TABLE 31. - SYSTEM DATA SUMMARY 


System 

type 

System 

no. 

MTBf 

(hrs) 

On - A/C 
MMIJ/KH 

Off'A/C 

MMII/KH 

On - A/C 
MIl/Main act 

Off - A/C 
MH/Main act 

MTBUR 

(hra) 

Test 

equip 

cost 

(K$) 

System 

weight, 

Ubsl 

System 
production 
- cost 
(K$> 

Reliability 

(Faii/FH 

xlO*"^) 

D&D 

plus 

prod cost 
(M$) 

Total 

support 

(M$) 

Support 

cost 

(!!■*•”) 

(»/FH) 

Material 

cost/repair 

($) 

Total 

lifc-cycle 

cost 

(M$) 


12 

338.8 

. 00419 

. 0114 

. 720 

1,955 

214.9 

534.6 

900.1 

293.5 

1. 47 

74. 30 

96. 12 

20. 51 

1275 

259. 3 


14 

339. 1 

. 00438 

.0130 

. 723 

1. 991 

206. 2 

534.6 

912. 7 

297. 2 

‘ 0.05 

75, 05 

99. 29 

21, 89 

1264 

266.9 


I4A 

306. 3 

. 00336 

' .0105 

. 718 

2. 32 

275. 7 

523.9 

913.2 

289. 5 

■ 0.05 

73. 49 

79. 06 

16. 93 

1328 

221.9 

Triple 

15 

335. 0 

. 00445 . 

. 0134 

, 722 

2. 00 

202.5 

537.8 

996. 7 

312. 2 

. 0. 50 

78, 05 

104. 14 

22.64 

1302 

276. 5 


16 

353. 3 

. 00403 

.0115 

. 732 

2. 09 

227. 0 

531. 3 

917. 7 

292. 5 

9. 2 

74. 10 

91. 75 

20. 06 

1280 

250. 0 


16 

193. 1 

. 00563 

. 0151 

. 781 

2. U 

173.8 

535.6 

944.0 

308. 2 

0. 13 

77. 24 

107.9 

24.84 

1157 

294.9 


19 

197. 7 

' , 00505 

. 0345 

. 72 

4.92 

177.9 

780.6 

993. 1 

321. 3 

1. 70 

79. 87 

112.97 

25. 12 

1220 

300. 1 


1 

133.8 

. 0084 

. 0430 

. 778 

3, 89 

120. 1 

783.6 

1260. 9 

422.6 

1. 70 

100. 12 

159. 57 

18.27 

1050 

259.7 


3 

• 144. 7 

. 0074 

. 0179 

. 774 

1.87 

130. 2 

541. 5 

1024. 7 

443. 2 

0, 37 

104. 24 

172, 37 

19.95 

1410 

279,0 


4 

196. 5 

. 0057 

. 0158 

. 800 

3. 24 

176.9 

536. 6 

1113. 7 

374.8 

1. 07 . 

90. 56 

131. 51 

15.17 

1438 

223. 3 


5 

164. 1 

.0068 

. 0366 

. 773 

4. 13 

147.8 

781. 5 

1155. 3 

381. 1 

0. 05 

91.89 , 

145. 16 

16.87 

1202 

239. 1 


6 

154.6 

. 00703 

. 0184 

. 782 

2. 05 

139. 2 

556.9 

1334. 5 

408. 5 

0. 85 

97. 29 

i48. 17 

17. 14 

1345 

243. 5 


7 

159. 7 

. 00686 

.0174 

. 789 

3. 00 

143. 7 

549. 0 

1092. 5 

376: 0 

1.08 

90, 79 

135.96 

15. 74 

1210 

228.7 


7A 

. 1 78. 7 

.00605 

.0165 

. 781 

2. 12 

160. 9 

542. 0 

1213. 5 

399. 2 

1.08 

95.43 

162. 90 

18. 78 

1632 

259.9 

guad 

8 

173. 4 

. 00616 

' .0158 

.770 

1.97 

156. 0 

556. 6 

1317. 7 

392. 6 

0. 16 

94. 00 

138. 27 

15.97 

1330 

233. 9 


y 

161. 0 

. 00669 

.0175 

. 775 

3. 03 

144.9 

556. 1 

1318. 5 

388. 3 

0. 26 

93. 30 

150. 20 

17. 10 

1380 

243.5 


9A 

180. 4 

. 00609 

. 0166 

. 790 

3. 15 

163. 4 

549, 6 

1439. 5 

411. 5 

0. 26 

97. 80 

174. 70 

19.97 ' 

1823 

272. 5 


10 

147. 0 

. 00763 

. 0488 

. 774 

4.95 

132. 5 

895. 5 

1084. 5 

354. 2 

0. 26 

86.43 

156. 57 

17.44 

1289 

243. 0 


11 

190. 6 

. 00574 

. 0161 

. 788 

3. 33 

171. 6 

546. 3 

1309. 5 

381. 2 

0. 25 

91.84 

131. 66 

14. 76 

1542 

223.5 


13 

' 179, 7 

. 0060 

1 

. 0149 j 

. 766 

1. 93 

161. 7 

549. 1 

1075. 7 

358. 9 

0. 62 

87. 39 

U9.71 

13.84 

1328 

208. 6 


13A 

301. 6 

1 

. 00533 

.0153 1 

. 733 

3. 33 

181. 4 

552. 7 

1069. 7 i 

352. 4 

0, 63 

86. 10 

m. 32 

12.85 ' 

1244 

198. 6 


17 

148. y 

. 00757 

. 0394 

1 

- 1 .• 7*^4 

4. 04 

133. 8 

784. 9 

1178. 5 1 

385. 7 

.. 0.80 

92. 74 

.158. 06 

10. 10 

1167 

250. 8 

Trip'dual 

30 

198. 5 

. 00503 1 

1 

.0353 1 

. 733 

3. 60 

178. 7 

671. 1 

859.0 

310. 2 

’ 0. 13 

77. 64 

107. 70 

24. 46 

1178 

292. 1 

Quint 

i 

2 

\ 

138. 9 

1 

.00856 , 

1 

1 

.0318* j 

. 795 

3. 02 

116. 0 

569. 7 
1 

1268. 5 

1 

443. 6 

1.95 

106.:22 

168. 88 

19. 23 

1083 

278. 1 





w 



1 ANALOG QUAD 
14 DIGITAL TRIPlf 

13A DIGITAL QUAD - MEDIUM PROCESSOR - SMALL PROCESSOR - SKEWED HEXAD SENSORS 
4 ‘ DIGITAL QUAD - LARGE PROCESSOR -‘SKEWED HEXAD SENSORS 
8 DIGITAL QUAD - MEDIUM PROCESSOR - SMALL PROCESSOR 


OPS PRODUCTION 

LIFE CYCLE MATERIAL SUPPORT RELIABILITY COST 

COST M$ $/FLITE HR $/FLITE HR XIO'^ ' K$ 



1 14 13A- 4 .8 ,1 14 13A 4 8 1 14 13A 4 8 ■ 1 14 13A 4 8 1 14 13A 4 8 


. Figure 144. - Comparison of Major Systems 


TABLE 32, - SYSTEM 13A LIFE-CYCLE 
COST BREAKDOWN 


Item 

Cost (M$) 

Design and development 

15.60 

Production 

70.49 

Stockage 

105. 07 

Test equipment 

0. 55 

Maintenance manpower 

0. 85 

Training 

0. 03 

Inventory management 

1.29 

Transporation 

3. 13 

Publications 

0. 13 

Overhatil 

0.27 

Dispatch 

1. 22 

Total life-cycle cost 

198.62 


TABLE 33, - SYSTEM 13A 
COST SUMMARY 


Item 

Cost 

Life-cycle cost (M$) 
Support cost^ ($/fit hr) 
Material cost^ ($/flt hr) 
Total cost ($ /aircraft /yr) 
MTBF (hrs) 

Total repairs ($) 
Reliability (failure /fit hr) 
System production cost ($) 

198.623 
12.85 
11. 99 
66,200 
201. 635 
48 272 
0. 63 X 10” ^ 
352,438 


^OH/FH = 1. 75 






dollars from Table 35. Thus, the UAL number is about 22 percent less than 
that determined for system 13A. 

Further details on the system 13A selection rationale and a descrip- 
tion of the various components (LRUs) and computational operations proposed 
for system mechanization are provided in Section 10, ".Selected System Des- 
cription. " 
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SECTION 10 

SELECTED SYSTEM DESCRIPTION 


‘ The recommended ATT flight control system, concept 13A, is a quad 
digital computer configuration employing a small microprocessor for input/ 
output control, a hexad skewed set of conventional sensors for body rate and 
body acceleration, and triple-integrated actuators. 

Reinforcing and complementing the concept's generally excellent show- 
ing in the life-cycle cost tradeoffs discussed in Section 9 were the following 
factors; 


• A digital system provides the best system mechanization when com- 
pared with analog and hybrid systems. 

• Use of a small I/O processor allows use of a medium-sized control 
processor and significantly reduces costs. 

• A 450- to 5QO-KOP central processor is needed for the ATT PCS. 

• Quad- redundant sensors and electronics coupled with triple actuators 
are required to meet system requirements at minimim cost. 

• Conventional sensors and actuators provide adequate performance for 
the ATT. 

A simple block diagram of the recommended configuration is shown in 
Figure 145. 
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Figure 145. Selected System. (13A) Functional Block Diagram 
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Line-Replaceable Units (LRUs) 


The following paragraphs describe the physical characteristics of the 
major units defined to mechanize the recommended configuration. The 
Advanced Technology Transport flight control system consists of 57 major 
LRUs of 10 different types. 

Input/output processor units (4) . - Each processor unit processes all 
pitch, roll and yaw inputs and outputs associated with a particular channel, 
providing multiplexed analog to digital and digital to analog conversions. Each 
I/O processor unit is interconnected with all four control computation units 
but is completely independent of the other three I/O processor units. The 
I/O processor units, being identical, are completely interchangeable, thereby 
reducing spares and provisioning requirements. The heart of each device is 
the small processor described in Section 6. A detailed description of the 
I/O processor unit operation is included later in this section. 

Control computation processor units ( 4 ). - Each control computation 
processor unit is interconnected with all four I/O processor units and, conse- 
quently, is provided with digitally crossfed signals from the full quadruple 
sets of ’sensors. Optimum signal selection and control law computation are 
the primary tasks of this device. The control computation units are again 
identical and completely interchangeable to reduce provisioning requirements. 
A medium-sized processor with characteristics defined in Section 6 is the 
computational element in each device. There is no direct intercommunication 
between the four control computation units. A detailed description of the 
control computation unit operation is included latei^ in this section. 

Flight guidance control panel (1) . - The flight guidance control panel 
provides FCS control and display functions for both the captain and first 
officer. Selection of control parameters (e. g. , altitude) and flight modes 
typify the control functions provided. Automatic mode transitioning (e. g. , 
from capture to track mode) typifies the display functions provided. 
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Maintenance assessment panel (1) . - The maintenance assessment 
panel (MAP) provides central control and display of the PCS self-test functions. 

Status panel (1). - The status panel displays FCS operational status 
information to the captain and first officer. 

Hexad body sensor unit (1). - The hexad body sensor unit incorporates 
six conventional spring-restrained rate gyros and six quartz-fiber pendulum- 
type accelerometers mounted in a. common casting at appropriate skew angles. 
The package also includes six independent sensor power supplies which are 
excited via crossfed protected lines from the four main power buses. ■' 

Flutter sensor unit (2) . - Each flutter sensor unit contains four con- 
ventional spring -re strained rate gyros and four quartz-fiber pendulurri-type 
accelerometers. One unit is mounted in each wingtip of the aircraft. ' 

The device includes four independent sensor power supplies, each 
excited directly from one of the four main power buses. ; 

f V 

Control wheel sensors (2) . - The control wheel sensors employ silicon 
strain gages mounted on a beam spring force sensor to sense pitch and roll 
wheel forces. The units are similar to current DC -10 control wheel sensors. 

Rudder pedal sensors (2) . - The rudder pedal sensors employ silicon 
strain gages mounted on a beam spring force sensor to sense rudder pedal 
forces. ‘ 

Integrated actuator units (39). - Integrated control surface actuators 
are mounted in triple -redundant configurations driving each control surface. 
These units are described in detail in Section 6. 

Summary. - Physical characteristics of the LRUs and the total FCS 
are presented in Table 34. 
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TABLE 34; - SELECTED, SYSTEM PHYSICAL CHARACTERISTICS 


/n *> 

^ i 

' 



■ } 

c: Weight (lbs) 

Power 

dissipation .• 
(watts) 

Unit 

Quantity 

Size, (in:’ ) 

Unit 

Total'; 

Unit 

' Total- 

Input/ output- processor unit ; 

’ - 4 

5 X 20 x 7. 6 

13. 2 

52 . 8 

80 

320 , 

Control computation processor unit 

:a 

: 7; 5.x 20 X 7. 6 ; 

.A 

19. 2 

. 76.8' 

120 

480 

Status panel. :: 

1 

5 X 5. 6 X 7. 6 

- 2. 5 

. ,2.5’ 

15 

15 ' 

Flight guidance control panel 

1 

3, 9 X 12, O x 23, 5 

18 

18 ■ 

35 

35 

Maintenance assessment panel 

1 

5.- 75 x 5. 6 X 7. 6 
■ ‘ ■ ' 

•3 

‘ 3 

22 

22 / 

Hexad body sensor unit 

.1 

8.x 8 X 16 

.12 : 

1*2 ' 

36 

" 36 ■ 

Flutter sensor unit 

2 

6- X 5. 2 X.8, 0 

7 , 

’ 14 

24 

48 

Control wheel sensors 

, 2 

.. 1. 5 X 3. 3 x:6. 0 

2. 0 

4 V 

1 

2 

Rudder pedal sensors 

. 2 

1. 5 X 3. 3 X 3..0 

1. 0 

2.0 

0. 5 

1 

. Integratejd actuator 

39 

' . . \ 

14 

. 546 















Operational Reliability 


The success path diagram shown in Figure 146 was used to determine 
the operational reliability for configuration 13A, A probability of loss of FCS 

-7 

functions of 0. 63 x 10 per flight hour over an 8 -hour flight period was 
established for this configuration. 

Construction 

The packaging philosophy is based on the use of 6-1 /4-inch-square 
printed circuit cards with the NAFI- style blade -type connector plugging into 
a metal base plate having wire-wrap interconnections. The wire-wrap wiring 
extends from the base plate to the test connectors on the front of the chassis 
and to connectors on the rear of the chassis. Where power and ground require 
heavier wire, stranded leadwire with conventional crimp or solder termina- 
tions is used. The printed circuit cards are primarily double- sided cards 
with components mounted on one side to facilitate flow soldering. The inte- 
grated circuits used are primarily in the dual in-line package (DIP) which is 
mounted directly to the card in plated-through holes. The cards are. keyed 
to assure proper location within the chassis. This circuit card packaging, as 
well as the chassis and wiring approach, have been proven in commercial 
applications such as the DC -10 DADC and PAFAM. 


Functional Operation 

The functional operation of the system is detailed in the following 
paragraphs. Both the redundancy and functional complexity of the recom- 
mended configuration are shown in Figure 147. 

Hexad body sensor unit. - The mounting of six conventional spring- 
restrained rate gyros and six flight-control-quality accelerometers in a 
skewed orientation is an unconventional concept which is not used in analog 
systems but is made feasible by digital computational capabilities. 
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Angular rate and linear acceleration information with respect to all 
three body axes is available from this configuration. The three-axis angular 
rate data is necessary for flight control application. Commonly only normal 
and lateral acceleration data is provided for flight control use; however, the 
availability of longitudinal acceleration data at essentially no additional cost 
will undoubtedly result in updated implementation which utilizes this informa- 
tion for flight control and/or engine control modes. 


The skewed hexad arrangement provides two-fail-operational relia- 
bility in a most efficient manner since the change in level of redundancy from 
single-channel to quadruple-channel is achieved with only an increase from 
three orthogonal sensors to a total of six in the skewed sensor array. • 


The redundancy level improvement is obtained with a minimum 
decrease in maintenance reliability. 

Full crossfeed' of sensor signals is desirable to improve operational 
reliability, since possible success paths are increased; The hexad arrange- 
ment minimizes the number Of inputs for full crossfeed; consequently, the 
analog-to-digital input and signal-selection capacity required is minimized 
in the processor. 

The skewed orientation approach permits use of averaging techniques 
to improve effective sensor accuracy. The reduction in sensor numbers, 
results in efficiencies in system volume, weight, power required and inter- 
connecting cables. 


Since the orientation of the sensor array is fixed and determined by 
the alignment of the mounting, the processing equations involve primarily 
multiplication by constant matrices which are easily entered in the computer 
memory. Very little of the computational capability of the machine is tied 
up processing this data. 
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Flutter sensor unit . - The wingtip-located flutter sensor units provide 
single-axis angular rate and linear acceleration information. Multi-axis 
sensors such as the magneto-hydrodynamic gyro and skewed arrays are, 
consequently, not appropriate for this application. 

This location is also subject to environmental, extremes and possible 
high vibration levels. The low-risk conventional spring-restrained ra^ gyro 
and pendulous quartzrfiber accelerometer were selected as the most satis- 
factory devices. 

Computational Operations ...... . 

: ^ _ ' . 

The two-processor-per-channel configuration provides the best fit 
between estimated processor computing power and ATT computational require- 
ments. In this configuration, shown in single-channel form in Figure 148, 
general input/output (I/O) processing is handled by a small processor (lOP) 
while the bulk of the flight control system computation is performed in a 
medium- size control computation processor (CCP). This basic task partition- 
ing scheme provides several advantages: 

• Lower overall cost through efficient use of the less expensive small- 
and medium-size processors. 

• High-volume production base through microprocessor technology; 
processors are standard with long-term availability. 

• Increased system reliability through excellent interchannel crossfeed 
capability at the lOP/CCP interface. 

• Reduced maintenance requirements by functional separation into 
simpler processors. 
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Figure 148. - Selected Computation Configuration 
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Processor descriptions . In the functional partitioning adopted in this 
configuration, specific computational tasks are assigned to each processor ‘ 
permitting an optimal fit. Tasks assigned to the lOP are; > • ‘ 

All input/output functions, including A/D and D/A conversion, multi-' 
plexing, de -multiplexing, bus control, etc. ' ' ■' 

Selection of CCP-generated servo command signals for final output 
to servos. . . . , . 

Detection and isolation of CCP failures via comparison monitoring of 
the servo commands. 

Detection of servo failures via modeling of the servo. 

Failure reporting to the status panel. 

Sensor, actuator, and lOP maintenance tests via interfaces with the 
maintenance panel. 

Specific tasks assigned to the CCP are; 

All flight control computations, e. g, , filtering, shaping, mode 
determination, etc. 

• Selection of sensor and other signals transmitted by the lOPs. • ■ 

■ . • ' ■ . i 

• Detection and isolation of lOP signal failures via comparison 
monitoring. 

• CCP maintenance tests, including independent interfaces with mainte-, 

nance panel. - 

• Failure reporting via independent interfaces with the status panel. 

In a multiple -computer configuration, processor intercommunication 
is a significant consideration in overall system design. Intercommunication 
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must meet the information transfer requirement without imposing undue load 
on the processors. In the selected configuration, intercommunication is pro- 
vided by serial, bidirectional buses under control of the lOPs. Manchester 
biphase coding is used to minimize transients. The processor-to-processor 
interface, inherent in this configuration, also provides a convenient point to 
incorporate channel crossfeed. The impact of crossfeeding on aircraft wiring 
and hardware complexity is minimized. 

A power supply is provided for the electronics in each channel. Regu- 
lated power is then fed to all elements of each channel. A detailed block 
diagram of a single -channel lOP and its electronics is provided in Figure 149, 
Virtually all of the flight control system I/O functions are processed under 
program control of the lOP. The total single channel I/O coniplement is 
summarized as follows; 


Analog a-c sensor signals (e. g. , vehicle attitude) 43 

Analog d-c sensor signals, (e. g. , vehicle acceleration) 17 

Discrete inputs (e. g. , localizer valid) 47 

Digital inputs (e. g. , air data) 1 

Analog outputs (e. g. , servo position command) 13 

Discrete outputs; 

Servo engage 13 

Sensor self-test stimulation 35 

Digital output, status panel 1 

Bidirectional bus interfaces (mode panel, 

maintenance panel, fourGCPs) 6 


Of the above, most are processed directly under program control. For 
example, when normal acceleration is required, the lOP executes a "select 
normal accelerometer and initiate A/D conversion" command. The I/O con- 
trol logic interprets this command, selects the normal accelerometer in the 
d-c conditioning and multiplex block, and causes the A/D converter to begin 
conversion. The lOP then proceeds to other tasks returning when the con- 
version is complete to extract the digital representation of normal accelera- 
tion contained in the converter register. A similar process is used for a-c 
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signals. Digital servo command outputs are converted and then reconstituted 
into a continuous signal via sample and hold circuits which approximate zero- 
order holds. Discrete inputs are level shifted to logic levels and interrogated 
by the lOP as specific bits packed into 16-bit words in the discrete input 
multiplex block. Discrete outputs, representing servo engage commands and 
sensor stims, are packed as bits in 16-bit words, stored in output registers, 
and level shifted to the required interface level (typically 28 Vdc). Digital air 
data are brought directly into the lOP memory. The air data are transmitted 
to the lOP in serial form; each word contains a label used by the DMA control 
logic to generate the lOP memory address corresponding to the air datum 
word. Bidirectional bus inputs from the CCPs are handled in a similar fashion. 
Each word contains a label generated by the CCP, which, with the receiving 
channel label bits, specify the appropriate lOP memory address. 

The status panel and bidirectional bus digital outputs are handled under 
lOP program control. Due to the limited address field anticipated in the lOP 

fy- , ■ 

instruction word, two lOP output commands are required. The first output 
provides the label for the intended output word; the second provides the datum 
word. The I/O control logic and output shift register assemble the data and 
label bits and control serial transmission through the transmitter(s) specified 
by the address field in the second lOP output instruction. 

Effective loading of the A/D-D/A, bidirectional buses, lOP, and CCP 
memory are obtained by reviewing the overall I/O task. Total I/O require- 
ments, including sampling rates, are listed in Table 35, The table indicates 
that 6420 A/D-D/A operations in the lOP and 7260 bus word transmissions are 
required per second. If the TOP and CCP operate asynchronously, these rates 
must be increased by five to reduce the variable "staleness" of information to 
20 percent of the overall sampling period. This would result in an A/D-D/A 
conversion period of Slysec; i. e. , the converter must complete one conver- 
sion every 31 usee. To achieve this in airborne converter hardware, two or 
three converters are required. Additionally, the TOP would be forced to 
operate in 31-jusec time ''chunks", effectively saturating it and precluding 
other tasks. Since it is readily achieyed on a frame (each 160th second) 
basis, synchronization is incorporated in this configuration. 
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TABLE 35 


Signal group 

Number 

of 

; Signals 

Type 

Rate 

(s/s) 

Trim inputs '' 

6 

■A/D 

10 

Control inputs 

6 

A/D 

40 

Rate and acceleration (hexad) 

, 12 

A/D 

80 

Surface, position 

8 

A/D 

40 

Surface rate and,4P . 

‘.16 

A/D 

40 

Surface position 

5 

A/D ‘ 

160 

Surface rate and Ap 

10 

A/D ' 

80 

Wingtip rate and acceleration 

4 

A/D 

160 

Servo commands 

' 8 

D/A 

40 

Servo commands 

5 

D/A 

160 

Servo command bite 

13 

A/D 

20 

Outer-loop signals 

; 29 

A/D 

20 

Discrete inputs ' 

4 wds 

Dig 

10 

Discrete inputs 

1 wd 

Dig 

40 

Discrete outputs 

. 3 wds 

Dig 

10 

Air data inputs 

3 wds 

Dig 

.10 

Panel inputs 

3 wds ' 

Dig 

10 

Panel outputs 

3 wds 

Dig 

10 

Miscellaneous digital 
in te rc om m un ic at ion 

10 wds 

Dig 

80 


Total 


End 

user 

a/d-d/a 

load 

(conv/ 

sec) 

Bus load , 
(wds/sec) 

Comment 

CCP 

60 

60 


CCP 

240 

240 


CCP 

960 

960 


CCP 

320 

320 


lOP 

640 

— 

Used in lOP 

CCP 

800 

800 


lOP 

800 ‘ 

— 

Used in lOP 

CCP 

640 

640 


lOP 

320 

' 640 

CCPr^IOP 
(request and response) 

lOP 

800 

1600 

' CCP^-^IOP 
(request and response) 

lOP 

' 260 

— 

Used in lOP 

CCP 

580 

580 






















An A/D-D/A conversion time of 80 nsec is readily obtained in airborne 
hardware. This includes multiplex switch settling, amplifier slew, actual 
conversion, hold circuit charging and all other parameters necessary to effect 
complete signal selection and conversion. Based on the 80-nsec time, the 
converter is occupied in the analog I/O process for approximately 50 percent 
of each second. The remaining time, plus the time available while awaiting 
conversion completion, is sufficient for the lOP to perform other tasks such 
as servo monitoring and CCP monitoring. 

Bus load is readily estimated based on the 7260-word transmissions 
per second estimated. For a 1-MHz bit rate and a 26-bit word (16 data, 

9 label, ,1 parity), effective bus load is approximately 21 percent; thus, bus 
loading imposes no constraint in this configuration. 

GCP. memory tie up, due to direct memory access (DMA) associated 
with intercommunication, warrants investigation. Since each CCP must 
receive signals from four lOPs the total number of DMA operations is 24 320 
per second; Based on a memory tie up interval (processor dead time) of 
lasec per DMA operation, a total dead time of 2. 4 percent results. This is a 
maximum as some DMA operations will occur during the arithmetic portion of 
the longer instructions (i. e. , MPY) and thus be transparent to CCP operation. 

Synchronizing logic is incorporated to synchronize the. lOPs with the 
CCPs. Four sync signals are transmitted (one from each CCP) to the lOPs. 
The signals are voted to develop one sync signal used as a "halt exit" (HEXO) 
interrupt to the lOP. Validity signals are used to disengage sync signals 
which occur too early or too late with respect to the other sync signals. Since 
the CCPs are synchronized on a frame basis, the four CCP-to-KDP sync 
signals will occur essentially simultaneously in normal operation. 

Self-test of the servo amplifier and servo engage output is included in 
the lOP electronics. This is accomplished by "wrapping the servo amp outputs 
around" as analog inputs for testing in the lOP. A similar "wrap around" 
technique is used for the servo engage discretes. A serial redundant switch 
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is included in the servo engage functions to assure disengagement in the event 
of failure of the output electronics. The lOP is estimated to be 89 percent 
loaded and requires approximately 3. 3K total memory. 

A detailed block diagram of the CCP and associated electronics is 
provided in Figure 150. Consistent with the task-partitioning philosophy of 
this configuration, little I/O is included. Bidirectional transmitter/ receivers 
are provided for each CCP/IOP bus and for the CCP/ maintenance panel bus. 
All bidirectional buses communicate directly with the CCP memory through 
the DMA control logic and port. Each word contains a label which is used by 
the control logic to specify the appropriate memory address. When a signal 
is requested from the CCP by the lOP, the label portion of the word is recog- 
nized as an output command, rather than as an input. The label specifies the 
desired parameter and the data bits are unused. The DMA control logic 
extracts the specified word from memory and provides it, labeled, on the 
appropriate bus. Output to the status panel is accomplished by the DMA I/O 
control logic on command from the CCP. Status panel words are extracted 
from memory and shifted out on the unidirectional bus to provide failure 
reporting. The CCP, a medium size processor, is approximately 88 percent 
loaded and requires approximately 8. 7 K of total memory. 

Monitoring Operation . - The monitoring configuration provides inflight 
failure detection and disengsigement of the affected actuators. Monitoring is 
accomplished by comparing, signals among channels. For example, the sen- 
sors and lOPs are monitored by the CCPs. Each CCP receives inputs from 
each of the lOPs, compares each input with the others in the redundant set, 
and selects the optimum input value. 

Similarly, each lOP receives servo command signals from each of 
the CCPs, compares each with the others in the redundant set, and selects the 
optimum value for output to the servo. The lOP performs self-test of the 
servo output electronics. When a failure affecting continued servo operation 
is detected in any of these areas, the affected servo is disengaged. Since both 
the associated lOP and the majority opinion of the CCPs may disengage the 
servo, high monitoring integrity is achieved. 
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A - FUNCTION REOO BY DMA I/O CONTROL LOGIC 

• RECOGNIZE WO RECEIPT FROM lOPU 8 MAINT PANEL 

• DECODE LABEL PORTION TO DETERMINE IF DATA REOUEST(TO BE 
TRANSMITTED BACK TO lOPU OR PANEL ASAP) OR DATA TO BE STORED IN CCPU 

• EXTRACT SPECIFIC WD ADDRESS FROM LABEL FIELD OF INCOMING WD 8 MODIFY 
AS APPROPRIATE TO DISTINGUISH SAME WD ADDRESS FROM DIFFERENT CHANNELS 

• IF RECEIVED WO IS FOR CCP , EFFECT STORAGE IN CCP MEMORY 

• IF RECEIVED WD IS DATA REQUEST, EXTRACT DATA FROM SPECIFIED ADDRESS 8 
TRANSMIT BACK TO lOPU OR PANEL 

• ON CCP COMMAND (DIRECT I/0)EXTRACT SPECIFIC W0(A/3)8 TRANSMIT TO 
STATUS PANEL 


Figure 150. - Selected System Control Computation Processor (CCP) Block Diagram 
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Actuator arrangement. - A triple-integrated actuator arrangement 
operates each of the 13 control surfaces. Operation in the active /on-line 
mode uses in-line monitoring techniques. Hydraulic power is supplied from.c, 
three primary dual-pump sources. The, flow capacity of each supply is, ade- *. 
quate for full control of the vehicle. . . 

A switched erossfeed from the four-channel I/O processor unit to the t 
three-channel actuator sets accomplishes the redundancy-level change. The 
output section of the fourth lOP is on standby (no output to the servo actuators) 
until a failure in one of the lOPs is detected. At that time, , the fourth lOP 'v^ill 
be switched in place of the failed unit. 

Maintenance test operation . - The maintenance test configuration. pro- . 
vides maintenance test capability to detect and isolate failures of the lOP, 

CCP, sensors, and actuators. Maintenance test functions may be initiated via 
switches on the. lOP front panel, the remote maintenance assessment panel, 
or as followup action after detecting an inflight failure. Self-test is accomr 
plished under program control by the processors and includes the tests 
described in the following paragraphs. 

Processor Tests . - Sample problems requiring all processor functions 
are performed with known inputs. Results are compared with, a predetermined 
requirement to assure proper processor operation. 

Memory tests. - Data memory is tested via summing of memory con- 
tent and comparing results against predetermined requirements. For variable 
data memory, termed scratchpad memory, known values (e. g, , all "l”s) are 
first loaded into all variable memory locations such that a unique result will 
be obtained unless a memory failure has occurred. Instruction memory is 
tested via distribution of the self-test programs in all semiconductor memory 
devices to provide detection of massive device failures (e, g. , output line 
stuck at ”1"). Additionally, instruction memory parity is incorporated as part 
of inflight monitoring to detect individual bit failures when the instruction 
memory is accessed. 
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l/O tests . - The various types of I/O functions are tested via several 
techniques. Discrete inputs are tested by stimulating the input circuits to 
each binary state ("0" and ”1") independently under processor control. The 
processor then checks for the appropriate binary value when the "stimmed" 
word is read. Servo command outputs are tested via returning the output 
signal, in analog form, back as a single-path d-c input. The processor then 
simply compares a known digital output value (which was converted to analog 
form in the output circuitry) with the corresponding measured input value. 

This' form of test detects converter and multiplexer failures as well as sample- 
an’d-hbld output failures. Servo engage discrete output circuitry is tested in a 
similar manner, i. e, , by returning the discrete outputs back as self-test 
discrete inputs with processor comparison of the measured inputs versus the 
generated outputs. Bidirectional bus input/output circuitry is tested in a 
"wrap-around'- manner as follows; The processor performs a unique output 
operation which loads the output register. As the parallel to serial register 
is shifted out,' it provides a serial output gated into the one of the serial input 
paths, thus providing an input to the processor. Performing this operation 
with known values enables processor comparison of the initial values with the 
resulting input value. Thus failures in these paths may be detected. When 
the lOPs and CCPs are interconnected as in the normal aircraft installation, 
bus circuitry is further tested by transferring known data from one unit to the 
other and back, enabling thorough testing of this function. 

Miscellaneous tests. - Additional tests are incorporated to assure 
proper operation. Typical of these are measurements of known voltages to 
further test the A/D converter and power supplies, testing of the redundant 
solenoid -engage switching used to assure actuator disengagement, etc. 
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SECTION 11 
CONCLUSIONS 


The trade study data generated during the course of this program leads 
to a number of significant conclusions. These conclusions, while being sub- 
ject to various study assumptions and having a high sensitivity to the 1978 
time frame, provide an insight into the concept and mechanization needs of an 
advanced complex flight control system and are discussed in the following 
paragraphs. 


General 

The results of the study show that the most cost-effective flight control 
system for an ATT aircraft using extensive active control technology can be 
implemented with the following technologies: 

• Computation — general-purpose digital 

• Sensors — conventional, g 3 mos and accelerometers 

• Actuation — integrated hydraulic packages 

The overall computational requirements of the ATT flight control 
system cannot be cost-effectively achieved with an analog system design. 

The computation task requires the use of a digital processor. The system 
requires a high-integrity BIT capability, a capability which is less expen- 
sively implemented digitally. These factors allow the required functions to 
be implemented at minimum life-cycle cost in a general-purpose digital 
processor. 

Conventional spinmotor rate gyros and pendulous force-rebalance 
accelerometers provide the best solution for meeting the sensing require- 
ments; all are currently used in flight control systems. The use of advanced 
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types of inertial sensors is not indicated because they do not appear cost 
effective at the precision level needed for control system use (as opposed to 
the precision level needed for navigation systems). 

Hydraulic actuation is projected as superior to other alternates, and 
the integrated hydraulic package is the most attractive mechanization. It 
provides the minimum cost per function because a single device accepts elec- 
trical command signals and outputs surface position and because it allows 
simplified monitoring and fault reaction since no intermediate crossfeeds 
are required. 


Specific 

Processors . - A small I/O processor coupled with a medium-sized 
control computation processor provides the optimum computing configuration. 
While meeting the ATT reliability and maintainability goals, this configura- 
tion provides the lowest overall costs, including initial acquisition as well as 
maintenance costs, throughout aircraft life. This lowest cost results from 
high utilization of hardware resources. Since the various computation con- 
figurations employ similar hardware technologies, overall cost tends to be 
proportional to hardware complexity, the least complex being the least costly. 

Greater processor efficiency is achieved with the recommended con- 
figuration than in the other configurations. The total flight control tasks 
were found to exceed the throughput capability of.the medium processor. 
Performing I/O, servo monitoring, and processor output selection in a 
separate I/O processor "unloads” the medium processor, thus providing an 
overall efficient fit. Despite an increase in the total task, due to the addi- 
tional interface between the processors and duplication of maintenance test 
functions in two processors, resource utilization is higher than in the single- 
large-processor configurations. It should be emphasized that this conclusion 
is predicated on a 1978 design, with the processor capability projected for 
that time period. 
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Sensors . - Conventional body-rate sensors mounted in a hexad con- 
figuration provide a benefit in reduction of support costs since six less gyros 
are needed to produce the body-rate information. The application of the 
hexad -configured gyro is well documented in terms of computation necessary 
to extract the orthogonal body rates and the effective redundancy^bbtained. 
Calculations of operational reliability, comparing the conventibhll gyro in 
an orthogonal, quad -redundant configuration to the hexad gyro, show negli- 

•r>-: -7 

gible change, both yielding a system reliability of approximately- 0. 63 x 10 
failures per flight hour for an 8 -hour time period. 

The decrease in production cost due to the application oMhe-hexad 
technique amounts to approximately 2 percent. The reduction in life-roycle 
costs however, is nearly 5 percent. This ratio is due to the significant 
contribution (about 30 percent) of gyros to the total life-cycle costi while 
the contribution to production cost is only 6 percent. Consequently, reduc- 
tion of the number of gyros wherever possible, or an increase in the MTBF- 
to-cost ratio, is a prime area concern for redundancy life-cycle costs. ■ 

Comparison monitoring . - Comparison monitoring techniques enjoy 
a high confidence level for sensors and computation functions because they 
are presently utilized for the most critical function similarly -implemented 
in current commercial transport application — the automatic all-weather 
landing system. Even in the autoland system, the most distrust evidenced 
by some airframe manufacturers is in the self-monitored sections .— the'. : 
localizer and glideslope receivers. The self-monitored air data computers 
are not used for autoland functions below the decision height; • . 

This lack of acceptance of self-monitoring is particularly significant 
in the ATT fly-by-wire system which eliminates the proven mechanical 
primary flight control equipment and does not include a mechanical backup. 
Opinion solicited from both airlines and airframe manufacturers indicate 
that the required confidence level for inline monitoring will not have been- 
proven in time for the ATT aircraft. United Airlines has reflected this view 
in their ATT minimum equipment list by specifying quad comparison-monitor- 
ed channels. 
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^ It is concluded that even though the fault^detection capability of self- 

^monitored sensors and computation can, be designed, to approach that of the 
comparison-monitored sensors and computation, the lack of operationail 
proofing,^and the unfavorable confidence level in the industry will not allow 
the full economic advantage of its utilization in the time frame or operational 
environment of the ATT. 

. Dispatch criteria. - Because of the costs associated with flight delays 
and flight cancellations, a primary driving force in determining redundancy 
level requirements is the "critical dispatch equipment" groundrule. The 
study ishows that flight-critical sensors and electronics must be quad redun- 
dant to avoid. severe cost penalties in operational use. 

The primary dispatch criteria is that the flight systems must be 
capable of sustaining a failure and remaining completely operational. This 
- criteria eliminates the dispatch of triple systems which have experienced a 
failure, since a second failure in a comparison monitored system renders it 
inoperable. The system would then have to wait for repairs, which signifi- 
cantly increases the life-cycle costs. Until inline monitoring techniques 
are thoroughly proven 100 percent effective, the use of quad comparison- 
monitored sensors. and electronics as a minimum-equipment item will be 
required. The quad equipment may be dispatched with a failure, thus elimina 
ting the need: to provide high-level maintenance capability at most stops and 
reducing the probability of delay and its associated costs. 

Actuators. - The recommended actuator' configiiration for the ATT 
aircraft is triple, integrated inline monitored sets. Each set is fail-opera- 
tional for two failures and will operate with a single surviving actuator in 
a set. 

The advantage of triple, inline monitored actuator sets is very signi- 
ficant in life-cycle cost, in aircraft weight, and in requirements for multiple 
independent hydraulic power and distribution systems. Inline monitoring is 
not acceptable for sensors .and computations as previously stated. The 
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reasons that, inline monitoring is favored for the actuation are first, the 
actuator closed loop can be easily modeled using input valve current, 
actuator velocity and actuator position. By comparing the actuator loop 
with its model, a very precise monitor can be constructed. Second, the in- 
line actuator monitor has been used in several current military aircraft, 
both transport type and fighters. Honeywell has successfully used inline 
servo monitors on the C-5A Galaxie, the F14 Tomcat, the X-15 adaptive 
system and the J37 Viggen. For these reasons, the design and development 
risk is considered minimal for application to the ATT. 

Because of the short stroke and relatively small surface moments on 
the wingtip flutter suppression surface, this actuator may be a triple-tandiem 
assembly for minimum cost, retaining a reasonable weight and volume for 
maintenance. The other control actuators are recommended as triple- 
parallel, since the stroke and force requirements require separation, of each 
actuator; a tandem package would be too large and heavy for maintainability. 

Life-cycle cost elements . - The dominant life-cycle cost elements 
are associated with the sensors and actuators. Although the initial produc- 
tion costs are dominated by the electronics, the improvement experienced in 
digital circuit reliability has significantly reduced its cost of ownership. 

The results show that the electronics represent around 60 percent 
of the production cost and actuators and sensors 38 percent. When reflected 
as life-cycle support, costs, the contribution of each of these classes of 
parts is essentially reversed. Electronics support costs represent approxi- 
mately 34 percent and actuators and sensors around 65 percent. The most 
dramatic effect is due to the gyros, representing 6 percent of the production 
cost and 30 percent of the total support costs. The percentage differences 
are: 
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Percent of 

Percent of 


Production Cost 

Support Cost 

Electronics 

58. 6 

33. 8" 

Gyr^os 

• 

CO 

29. 6 

Accelerometers 

4.7 

11.7 

H 3 rdraulics 

27.4 

23.3 

Miscellaneous 

3.2 

1.6 


100.0 

100.0 


Redundancy management . - Redundancy management requires a signi- 
ficant portion of the computation load. Even though the signal-select algo- 
rithm’ requires less than 200 add times per signal selection, the total signal- 
select function consumes nearly 50 percent of the computational time for a 
quad-redundant system due to the number of sensors and the'itSraBdn rates 
required. 

A quad system employs 11 sensor sets and 13 sets of actuator feed- 
back signals on which the signal select must act. The fl^ht control system 
employs five sample rates, 160, 80, 40, 20 and 10 Hz. The flutter suppress- 
ion is computed at the highest rate, and mode logic, for the most part, at the 
lowest rate. 

The 160-Hz rate path does signal select on the 4 wingtip sensors. 
Hence, the total signal select time for this path alone is (4 x 160 x 176) 113 
KOPs per second. The remaining paths 80, 40 and 20 Hz Consume 88 KOPs 
per second for a total of 201 KPSs per second; the signal select for a quad 
redundant system consumes nearly 20 percent more time. This points up the 
need for careful analysis and selection of the signal-select alorithm. 
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Computer requirements . - When addressing the question of computer 
requirements for the ATT, the key elements leading to an answer which 
yields a low-risk and yet cost-effective machine are: ; ' 

• The ATT is considered to be a production aircraft. ‘ 

• A 1978 go-ahead is assumed. 

• Conventional frequency shaping will be used for the control laws. 

Based on these elements, it was concluded that a m^ium-speed, 16- 
bit fixed -point arithmetic machine with a double-precision mode will do. th^ 
control computation task. For a large-rvolume production aircraft, computer 
cost becomes an important factor. This points to a machine which will have 
sufficient throughput and an adequate instruction repetoire but which does ^ , 
not include features such as indirect addressing and floating-point arithmetic 
.which are primarily programming aids that add to the production hardware 
costs. . . 

With a 1978 go-ahead date, it is most unlikely that sophisticated con- 
trol techniques employing matrix operations will be employed; rather the , 
control law computations will utilize conventional digital frequency-shaping 
techniques. With the exception of the 160-Hz sample rate for the flutter , 
mode and the gust maneuver load control, a fixed-point, 16-bit machine is 
satisfactory. For the high-rate computations, 24 bits, are required to reduce 
the deadbands to a satisfactory level; however, the cost-effective solution is 
the use of double-precision arithmetic for the 160-Hz rates. 

C-MOS circuitry . - The use of C-MOS circuit technology is anticipated 
due to a number of advantages associated with it: 

• Low power dissipation resulting in lower operating temperatures and 

improved reliability • • 

• Excellent noise immunity ' 
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• Adequate speed - . , . . 

• Single supply voltage , . 

• Availability in a variety of logic functions with two or more sources 

• Increasing acceptance and application implying continued availability 
throtigH the ATT lifetime 

The semiconductor manufacturers have begun to exploit significant new 
inarket areas’ in high-volume cbmmerciaTelectronics; the small calculator, 
automotive electronics, and wrist_watches. exemplify a few. As a result, the 
’ sbmi conduct or manufacturers’ direction appears to be one of further develop- 
ing such markets and increasing production capacity to meet the demand. The 
manufacturers Have expressed little interest in low-volume custom LSI pro- 
duction, particularly where airborne environmental requirements are imposed. 
Consequently, custom LSIC are not expected to be available. A possible 
exception to this is the processor itself. Since processors are general- 
'purpose devices applicable to many different systems, high-volume pro- 
duction and second sourcing are anticipated for custom processor LSIC chips. 
For these reasons, it is projected that the ATT flight electronics will be 
largely based on use of the C-MOS standard circuits. 

Semiconductor memories . - Semiconductor memories provide 
several advantages: 

• Low cost 

• Low power 

• High packaging density 

• Nondestructive readout (ROM and PROM) * 

• Fixed program content (some types may be altered via special 
loading devices) 
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The last of these, fixed content, is an advantage in that inadvertent 
and permanent modification cannot occur as a result of transient or improper 
processor operation which "rewrites" a portion of the program and appears 
as a permanent failure of the affected channel. However, it is advantageous 
only if few program changes are required. Following certification, changes 
are not anticipated for the ATT flight control system. By using alterable 
memories (core, plated wire or alterable semiconductor) during the precerti- 
fication stages, the advantages offered by semiconductor memories can be 
realized in the. ATT flight control system. 

Memory circuit technology will be a mix of C-MOS, N or P-MOS, and 
bipolar. Scratchpad memory will use C-MOS RAM circuits which provide 
adequate speed' and require very low power. The bulk of the instruction and 
constant memory will use G-MOS ROMS which provide the same advantages 
as the C-MOS RAMS. Standard PROMS (bipolar, N-MOS, or P-MOS) will 
be used for low-volume customer options or where infrequent changes occur. 



SECTION 12 
FURTHER STUDIES 


During the conduct of this study several items arose which were con- 
sidered at. a.; level consistent with the scope of the study, but which are 
deserving of; analysis in greater depth. Some of these items may be under 
study for military and space applications, but these studies may not fully 
evaluate the problems unique to commercial air service and their applicability 
to the ATT. 

The areas in which further study appears to be the most fruitful are 
redundancy management, engine-flight control integration, pilot interface and 
natural hazards. Each of these items are suggested for further study as 
defined in ^e following paragraphs. 


Flight Control/Propulsion Control Integration for Fuel Conservation 

In view of a continued shortage of fuel and an associated price rise for 
the quantity available, it is worthwhile to consider fuel-management techniques 
for an ATT -type vehicle. 

Energy conservation for various military-class aircraft has been a 
subject of several studies which resulted in the prediction of significant fuel 
and/or time savings, or range extension. At present, effort is being expended 
toward the realization of an algorithm allowing an on-line, real-time energy 
management computation. 

The means by which the aircraft resources are most effectively used 
is through flight path optimization. There may be several criteria for the 
optiniization — minimum time -to -climb, minimum fuel, etc. Optimal flight 
paths are described usually as mach -altitude schedules, the development of 
which has been tlie subject of Honeywell studies investigating propulsion 
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management systems for military aircraft. For a commerical vehicle, 
bounded by given climb, cruise and descent boundaries, the schedules must 
be modified, thereby not yielding the most optimum path but the optimum 
yield within the constraints. 

The advent of digital control, both for the flight control system, and 
for propulsion control yields some potential benefits. Certainly, the com- 
munication between the fuel management autopilot and propulsion control is 
made more efficient. Indeed, some of the computational load for optimization 
may be borne by each of the control -oriented machines. 

Furthermore, some optimizing may be done within the engine itself 
using limited search techniques. The projected ATT engine with the potential 
of a movable exhaust nozzle, inlet variable geometry, and variable fan 
geometry provides parameters needed to accomplish some propulsion system 
optimization. 

The propulsion control computer allows communication with the auto- 
pilot in terms of thrust, rather than throttle angle. In addition, there is the 
potential of the propulsion computer having the capability of engine perform- 
ance prediction over the anticipated flight regime. This type of information 
is used as input to the optimum flight path computation. 

Some potential areas of study relating to the commerical aircraft 
energy conservation problem are as follows; 

• The effect of the limited flight boundaries on commercial aircraft, 
and the excess fuel consumption due to these paths. 

• Examination of off-design point effects, such as cold and hot day 
operation, and the compensating benefits a system might achieve. 

_ • Determination of the mode, such as altitude or mach hold, in which 
the fuel management approach might best be implemented. 
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• Determination of those variables, such as the geometry within the 

Vy.. : . 

engine, which provides the most influence on the fuel optimization 
problem. 

• Generation of propulsion system performance model utilizing charac- 

• teristics already associated with the propulsion control system. 

• A cost study to determine the overall savings potential obtained through 
the application of energy conservation techniques. 

Redundancy Monitoring Techniques 

The ATT requires a Flight Control System which is fail operational 
through a second failure, to meet the dispatch requirements of the airlines 
for a Fly-by-Wire system. 

, To attain the required operational capability it is necessary to employ 
redundant channels and monitoring to determine the failure status of each 
channel. There are two monitoring techniques to fulfill the fault detection 
needs. First, is comparison monitoring which depends on the comparison 
of at least three operating redundant channels to make a decision. The second 
is in-line or self-monitoring which relies on the ability of a single channel to 
perform a 100 percent effective self-test. 

The use of self-monitored computers and sensors is not accepted by 
the users as a proven concept for flight control critical functions on a com- 
mercial air transport. This lack of confidence on the part of the users is due 
to the absence of operational experience and supporting analytical data and 
proofs. 


It is suggested that further studies be made to provide, at least in 
part, the analysis required to prove the effectiveness of in-line monitoring 
and thus, gain the cost advantages inherent in this monitoring technique. 
This should include analysis of low cost methods to improve processor. 
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memory and I/O self-tests and methods for failure modes analysis which 
give confidence in the analytical results. 


Redundancy Management /Signal Select 

A key element in the redundancy management of digital flight control 
systems is the signal-select algorithm. Currently employed algorithms have 
been digitizations of techniques employed with analog systems, and, conse- 
quently, in a multiple -channel digital system, the signal-selection task 
represents a significant amount of the total computation time. By taking 
advantage of the unique features of a digital computer, it should be possible 
to develop signal-select algorithms with reduced time requirements and still 
retain the desired fault-suppression characteristics of signal selection. 

A popular signal-select technique is median select. The corresponding 
digital algorithm for median select require 86 add times per signal per itera- 
tion for triple signal-select and 172 add times per signal per iteration for a 
quad signal-select. Thus, the impact of using 20 signals sampled at 40 
iterations per second yields the following computer through-puts in KOPs 
per second; 

Triple select 68.8 KOPs/sec 

Quad select 137.6 KOPs/sec 

These nurnbers represent a substantial portion of a small or medium 
processor time load, as much as 50 percent using the quad select algorithm. 
Although a small reduction in time could be achieved by improving the time 
efficiency of the algorithm, the fundamental difficulty results from the fact 
that the function is a digitization of an analog implementation. 

The selection of a signal-select algorithm is an integral part of the 
overall signal-select philosophy. The signal-select concepts, such as, voting 
or median select, are the essence of the signal-select algorithm. Developing 
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a signal-select philosophy tailored to the memory storage and arithmetic 
capability of a digited processor should yield an algorithm which requires 
considerably less computation time than the current algorithms. This effort 
is considered to be of considerable significance in the development of future 
multiple-channel digital flight control systems and is recommended for further 
study. 


Natural Hazards /Lightning Strike 

The effect of lightning strike on an electrical fly-by-wire aircraft 
becomes very critical, especially in passenger aircraft. The candidate 
system concepts were all designed to meet the requirements of MIL-STD- 
461A which has been considered adequate for flight control design in com- 
mercial transports. New design guidelines are needed, however, for electric 
fly-by-wire, and some very interesting work is under way. The General 
Electric High Voltage Laboratory is surveying lightning strike results in the 
Airline^Lightning Strike Reporting Project, and Lightning Transients 
Research, Inc. , is assisting in the development of design guidelines for the 
B1 bomber. These and other similar work should be investigated and the 
applicable results evaluated for the ATT. 

The generation of design guidelines for the ATT would require the 
consideration of special treatment for cabling the ATT FCS. Because the 
FCS wiring will be present in so many parts of the aircraft, due to electrical 
data transmission rather than mechanical transmission, and because of the 
higher-order mode implementation and the consequent multiplicity of sur- . 
faces and sensors, protection would be very extensive if required. The pro- 
tection normally considered from the aircraft skin should be considered for 
its effectiveness throughout the airframe w'herever FCS wiring is projected. 
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Pilot Interface /Annunciation and Displays 

As automatic control systems have become more complex, the pilot 
interface has become more sophisticated, allowing the pilot to be aware of 
the system status. An example of this trend is the use of wor d-pties sage- 
mode annunciators presently implemented on the DC 10 for ^e flight guidance 
and control which are espe^cially oriented toward the autoland maneuver. , 

. • . ’JL 

The pilot interface with a system such as the ATT. FCS,, with its . 
unique requirements and adyanced functional requirements is considerably 
more demanding than those previously encountered. The scope of the, present 
study did not permit an in-depth examination of. what should, be displayeii or 
what strategies would be appropriate for display generation. Electronic 
displays themselves warrant further investigation and should be considered 
candidates for future ATT work. . 

The use of electronic attitude indicators (EADI); multifprmat displays 
(MFD), and other advanced display techniques should significantly enhance, 
the pilot interface and provide a reduced crew workload. 
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APPENDIX A 
STUDY METHODOLOGY 


■' Thfe system tradeoffs' were based on the total life-cycle cost for -the' 
flight’contror system as determined in- an operational environment defined by 
Section 8. By niaktng all tradeoffs against a common element (cost)> and - ' ’’ 
without deviation from basic performance requirements, a true tradeoff is 
achieved; since fhe analyst is forced to evaluate every decision factor against 
the' common element.' A set of minimum requirements =was evaluated for each 
function or mode.' For example,' the fly-by- wire functional reliability. was • 
estal^ished considerably higher than the functional reliability for -relief modes. 

■ Final system selection was on the basis of various life-cycle cost ele- 
ments generated by the GEMM program (ref. - 1). -■ This computer programiwas 
designed to simulate a logistical support system for purposes of early system 
evaluaUon, • A-rnore detailed program description appears later in this 
apiiendik’.'' 

Included in the major tradeoff parameters were research and develop- 
ment costs, production costs, support costs, and operating costs. The 
support-cost determination integrates the effects of system size, complexity 
and reliability with an assumed route structure and maintenance philosophy. 
This cost is computed utilizing the GEMM program. The research, develop- 
ment and production costs are generated as a function of the design concept, 
i. e. , functions, module count, different types of boards, development required, 
new tooling and other equipment parameters. Although the physical charac- 
teristics such as volume and power have an influence on operating costs, all 
systems were relatively close to one another with one exception. This com- 
parison was consequently disregarded for tradeoff purposes. 

The design requirements for the above studies are defined in Sections 
3 and 4 which provide block diagrams and performance requirements for the 
functions to be included in the study. The mechanizations to be evaluated are 
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based on redundant integration of various sensor types, computational methods, 
servoactuator configurations and data-transfer methods. The various candi- 
date configurations to be evaluated will be reasonable extrapolations of 
advanced techniques estimated to be available and applicable in the 1978-1985 
time span. 

Study Process 

The study process generally adhered to is shown in Figure Al, and 
the following paragraphs provide some definition to each of the study steps. 
Figure A2 defines the system elements. 

Technology survey. - The results of the technology survey were a 
starting point for the trade studies. Electronic circuitry, sensors, hydraulic 
system concepts and digital processors were identified as probable hardware 
items available for the 1978 time period. 

Component definition and characteristics. - From the technology sur- 
vey, the components most likely to be utilized in the stated time period were 
defined in terms of their size, weight, power consumption, and mean time to 
failure. As used in this study, component relates to times such as digital 
processor, an analog computer, a gyro package, or an air data computer. 

Piece part definition and characteristics . - Also from the technology 
survey, the individual piece-part items such as resistors, integrated circuits, 
position sensors, pressure sensors, gear trains, transformers or individual 
gyro elements were defined in terms of their cost, reliability, size and weight. 

Functional requirements . - The functional requirements are the basic 
vehicle performance, maintainability and reliability requirements that all 
candidate systems must meet. 
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Figure Al. - Study Flow Path 
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The modes which ai:e necessary to the control mechanization are listed 
and include, for example, stability augmentation, flutter suppression and load 
alleviation modes. 

Functional block diagrams. - Based on the functional requirements, 
functional block diagrams were prepared depicting the control modes to be 
mechanized. Section 4 contains the block diagrams used for the system studyi 

Mode reliability . - At this point in the study, the reliability apportion- 
ment for each of the control modes was established based on the functional 
requirements. This apportionment was weighted according to the importance 

-7 

of the mode to safety of flight. All systems had to meet 1x10 failures per 
hour as a minimum requirement. 

Subsystem reliability requirements. - With the mode reliability 
apportionment known, the subsystems comprising the mode may be assigned a 
reliability. A subsystem is defined as consisting of several components con- 
nected together to perform a given task. An example may be the redundant 
configuration of servoactuators and necessary driving electronics to close a 
local servo loop. The component reliability was computed as part of the 
GEMM program and was based on piece-part reliability data. 

Computational sizing. - - The functional block diagrams in Section 4. 
defined the modes and functions to be included in all candidate configvu'atioas. 
The computational capability required to implement a nonredundant single- 
channel flight control system providing these modes; arid functions was then 

( 

determined. This included instruction sizing, timing requirements and mem- 
ory capacity definition. ^ The additional capabilities necessary to implement 
redundant channels were then added to the basic control law computation. This 
■ includes redundancy management and signal-select processes. 

Subsystem tradeoff and definition. - At this point, the various sub- 
systems designed to accomplish the control mode function were examined, and 
those which provided the best combinations were selected. The results of this 
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level of study were then, used in a number of candidate systems. 

Systems mechanization and candidate definition. - The results of. the . r 
various subsystem trade studies were used to devise 24 candidate systems. 

The functional paths developed were utilized in a number of the candidate sys- 
tem combinations. The various systems are described in Section 9. 

Reliability success diagrams. - Based on the system mechanization, 
success -path diagrams were derived for each candidate system. 

System maintainabilityi definition . - The overall system maintenance, 
man hours per flight hour along with the system reliability, form two of the 
major design parameters that are specified as basic fundamental requirements. 
Maintenance parameters were computed in the GEMM program based on indi- 
vidual module, and component estimates. . 

Weight and size definition. - With the candidate system mechanization 
known along with the characteristics of the components which comprise each 
system, the major physical parameters were determined. The size and weight 
parameters are broken down to the major package level including items such 
as actuators, computers, gyro packages, display packages and inertial meas- 
urement units. The GEMM program provides weight down to the module level 
to determine transportation costs. 

Cost summaries. - Four major cost items were derived from study 
data; research and development costs, support costs, production costs and 
operation costs attributable to the system mechanization. 

Research and development cost: These costs were developed from 
past experience associated with similar systems. The mechanization, re- 
dundancy management, state of sensor development, and built-in-test imple- 
mentation are examples of the items influenced by these costs. 
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Production cost: This cost is primarily related to the quantity of hard- 
weu'e per system, the handling processes necessary, and level of automated 
equipment and associated personnel skill levels required. 

Support costs: Support costs were computed by the GEMM program. 
The data inputs and outputs are described in detail in a later paragraph. The 
results were tabulated in Section 10. 

Operations cost: These are costs attributed to aircraft delays and 
cancellations due to problems with the flight control hardware. It is coupled 
to the system's redundancy level, and its mean time to first failure character- 
istic. These costs were fully described in Section 8 as part of the operational 
model; 

Airline operations. - This was primary input to the study prograun. 

The parameters defined here include some of the following items as examples: 

• Airline route structure 

• Average operating times 

• Average flight distance 

• Depot shop locations 

• Depot shop capabilities 

• Test equipment requirements 

• Manpower skills required 

• Scheduled maintenance assumptions 

• Logistics considerations 

• Stockage levels 

• Publications. 

These, and other operational parameters were obtained primarily from 
present practice on vehicles such as the DC-10. It is thought that this will 
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closely represent the airline practice in the 1980 to 1985 time period. The, 
operations structure is defined in detail in Section 8 of this report.. All of the 
parameters listed form inputs to the GEMM program. ., , 

System selection. - The cost data from the above calculations were 
then summarized along with the research and development, production, and 
GEMM-computed costs in tables provided in Section 9. Due to the assumption 
that all systems are designed to meet the minimum performance requirements, 
the minimum-cost system was considered the "best" choice of the candidates 
available. Plots of the summary cost data are provided in Section P>. 

GEMM Program , , . 

General Description. - The prime output of the ATT study was a trade 
study which compared the cost of ownership for the. various systems con- 
sidered. It was intended that this study be sensitive to the .cost, complexity, 
and reliability of individual circuit boards and nonelectronic components. 

The Army-developed GEMM (Generalized Electrpnics Maintenance 
Model) computer program provided the level of detail necessary to evaluate 
this somewhat subjective item. The GEMM model was designed to simulate 
the army logistics support system for the purpose of early evaluation of candi- 
date system designs. . With some minor changes, it was felt that the airline 
structure was suitably represented since the equations used are generalized 
maintenance and stockage formulas. The intent was, to "provide management 
with the capability to study the interaction of , the many elements of equipment 
design and logistics support and the effect that each elem.ent has on life cycle 
support costs and operational availability".. A, complete description, with 
equations, appears in reference 1 from which the following comments were 
excerpted. 

The GEMM model belongs to that class of mathematical models nor- 
mally referred to as a "support" model. A support model is a representation 
of an actual support system. This representation may be accomplished in a 
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number of ways but the most common means is by simulation or mathematical 
equations or a combination of both. Some support models can be exercised 
by hand, but in most cases support models are computerized. 

For the most part, GEMM utilizes mean value for input data. This 
type of data is available or may generally be obtained within the maintenance 
structure. GEMM does, however, consider confidence limits for stockage 
based on the Poisson distribution. 

Again, to be realistic, GEMM is compatible with the actual mainte- . 
nance structure. Iteta such as number of equipments in the structure, the 
number of organizational, direct, general and depot support shops, etc. , are 
required by GEMM. Decisions made by the model are based on life -cycle 
support costs. 

The GEMM model is not a compilation of sophisticated mathematical 
manipulations. It makes use of standard methods of determining logistics 
support requirements. The attribute of GEMM is not its utilization of complex 
computer -oriented operations research techniques but the speed with which it 
performs previously manual calculations and the integration of design and 
logistics variables to provide a total-picture approach to design and logistics 
decision-making. 

The effect that changes in spares policy, manpower, test equipment, 
etc., will have on the support system life-cycle cost and the equipment opera- 
tional availability can be shown over a wide range of values. Likewise, the 
effect of design changes in reliability and maintainability can be assessed and 
reliability-versus-maintainability tradeoffs can be performed. . These investi- 
gations can be accomplished using estimated and predicted values to assist in 
the decision-making in the early design stages before equipment design stages 
before equipment design and logistics policy have been firmly definitized. 

The speed with which GEMM can be exercised on the computer permits 
sensitivity analysis yielding instantaneous evaluation of alternative solutions. 
Many iterations of-the input data- may be accomplished such as different MTBFs, 


365 


MTTRs, stockage confidence levels, and other input variables. This sensi- 
tivity analysis permits detailed analysis of the effect of design and logistic 
parameters on life-cycle support costs. Sensitivity analysis can be used to 
pinpoint system parameters that will have a significant impact on life-cycle 
support costs in order to "zero-in" on these critical factors. 

Furthermore, the model can be exercised with updated information, 
as performance data becomes available, to verify earlier decisions. The 
maintenance philosophy of fielded equipment can be analyzed to determine if 
certain changes might yield a more cost-effective support system. . 

Four categories or echelons of maintenance are defined for the study. 
These are organizational support, direct support, general support, and depot 
support. Table A1 defines the action occurring at each of these levels as it 
pertains to the ATT study. 

The GEMM model is not constrained to the general maintenance organi- 
zation shown in Table Al. It has the flexibility to investigate various struc- 
tures. To accomplish this variation of structure, it is necessary to identify 
several maintenance actions without restricting the echelon at which they 
could occur. . . . 

The maintenance actions are: check out equipment (COE), fault isolate 
to component (FIC), fault, isolate to module (FIM), fault isolate to part (FIP)» 
throwaway module (TAM), throwaway component (TAC), and throwaway equip- 
ment (TAE). COE is the only restricted action, and it must be accomplished 
at organizational support. COE is the action required to determine that the 
equipment has failed. FIC is the maintenance action that is required to fault 
isolate the failed equipment down to the component level (i. e., to locate the 
failed component), and it can occur at any one of the four echelons. 

Correspondingly, FIM is the action required to locate the failed module, 
and FIP is the action required to locate the failed part. It is assumed that the 
actions must be performed in sequence; i. e. , before FIP can be performed it 
is necessary to perform COE, FIC, and FIM respectively. 
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TABLE Al. - LEVELS OF MAINTENANCE 


Category 

Organizational 

maintenance 

Direct support 
maintenance 

General support 
maintenance 

Depot 

maintenance 

Level 

1 

2 

■ 

3 

4 

Done 

where 

On aircraft 

On aircraft and 
airport dock 

In maintenance shop 

In maintenance 
shop 

Done by 
whom 

Line maintenance 
personnel, level 1 

Line maintenance 
personnel, level 1 

Shop repair 
personnel, level 2 

Shop repair 
personnel, level 2 

Basis 

Utilize BITE and 
checkout equip- 
ment 

Identify failed 
component and 
replace (LRU) 

Identify failed module 
and replace 

Identify failed 
part and replace ■ 

Type of 

work 

done 

Inspection, 
servicing 
adjustment, 
minor repair 

Inspection, 
servicing, adjust- 
ment monitor 
repair, LRU 
replacement . 

Inspection, complicated 
adjustment, use of 
automated test equip- 
ment, major repair, 
circuit-card-level 
replacement 

Inspection, most 
complicated 
adjustment, repair 
and replace, major 
overhaul, circuit- 
card repair, 
hydraulic repair 



For the most part, the straightforward four-level maintenance struc- 
ture will be utilized; however, some throwaway maintenance policies will be 
considered. 

Inputs to program. - The GEMM model utilizes mean values for inputs 

in order to reduce the magnitude of the data-collection effort. Also, to further 

• . ) ■ 

minimize data gathering, the number of data inputs is held to the absolute 
minimum commensurate with the level of detail provided by the GEMM pro- 
gram. The general data requirements for GEMM include;, 

1 ■ 

• Reliability and maintainability information 

• Research and. development costs 

'V ' Maintenance structure ' 

• Test equipment 

• Personnel 

•' Attrition factors 

• Transportation 

• Publications 

• Stockage information 

• Economic life 

Reliability and maintainability information is required for the end 
item and for each component, module and part class within the end item. To 
reduce data collection for individual pieceparts, they will be structured into 
what will be called part classes. 

This structuring will place parts of similar cost and MTBF into one 
class which will conserve program data card and execution time. Wherever 
a part does not logically fit, a part class will be assigned to that part alone. 
With the parts failure rate given, the module, component and end-item mean 
time to first failure will be computed. 
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The operationsil profile for the equipment under consideration must be 
entered into the model. The profile includes such information as hours of 
operation per day of the equipment, number of days per year of operations, 
and restrictions on maintenance shops such as number of shifts, hours per 
shift, number of shop operating hours per year, etc. 

Maintenance structure information is required, such as the number of 
organizational shops supported by one direct support shop, the number of 
direct support shops per general support shop, etc. Also, distances between 
shops, and number of equipments supported per shop are other examples of 
structure data requirements. 

Test equipment and maintenance personnel requirements are needed 
as inputs to the model. Test equipment information is input by type and cost, 
and maintenance personnel are described by skill -level type and pay allowance 
per year. 

Attrition factors are input to the model to reflect damage and other 
nonoperational failure. Transportation information includes distances between 
shops, as mentioned previously, the cost per pound per mile for transporta- 
tion, and the weights of the modules, components and the end item, 

Stockage information includes the array of confidence levels to be 
investigated, the turnaround times, order-ship times and the length of the 
replenishment periods. Also included is the cost of the spares. And, a final 
input is the economic life to be considered for the equipment under study. 

These inputs have been discussed in general categories. Table A2 
provides a more detailed listing of input data requirements. 
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TABLE A2. - GEMM INPUT REQUIREMENTS 

1. Number of components in equipment 

2. . Number of classes of parts in equipment 

3. Number of modules in each component 

4. Number of each part class in each module 

5. Reliability information based on equipment operating hours for each 
part class 

6. Mean -time to check-out the equipment 

7. Mean-time -tp-repair information based on active repair time (fault 
diagnosis + replacement time + retest and recalibrate time): 

a. Mean-time -to-^repair the equipment 

b. Mean-time-to-repair each component 

c. Mean-time-to-repair each module 

8. Cost of the equipment 

9. Cost of the components 

10, Cost of the modules 

11, Average cost of each part class 

12, Number of different types of test equipment required to perform all 
maintenance functions 

• 13. Test equipment required to check-out equipment 

14. Test equipment required to fault isolate to the component 

15. Test equipment required to fault isolate to the module 

16. Test equipment required to fault isolate to the part 

17. Cost for each type of test equipment 

18. Number of different types of manpower skill levels 

19. Skill level required for check -out -equipment 

20. Skill level required for fault isolation to component 

21. Skill level required for fault isolation to module 

22. Skill level required for fault isolation to part 

23. Cost for each type of skill level (per year) 

24. Weight of the equipment 

25. Weight of each component 

26. Weight of each module 

27. Number of equipments serviced per shop at each maintenance level 
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TABLE A2. - GEMM INPUT REQUIREMENTS - Concluded 

28. Number of maintenance shops at each maintenance level in the force 
structure 

29. Distance in miles between each maintenance level (between Org and DS, 
DS, and GS, GS and Depot, also Org and GS, Org and Depot, DS and 
Depot) 

30. Cost per pound per mile for transportation (between the different shops) 

31. Requisition time for a- part from the depot if part out of stock at level (L) 
where L can be Org, DS and GS and Depot 

32. Requisition time for throwaway module from Depot if module out of 
stock at level' (L) where L can be Orgn, DS, GS, arid Depot 

33. Requisition time for throwaway component from Depot if component out 
of stock at level (L) where L can be Orgn, DS, GS, and Depot 

34. Requisition time for spare equipment from the Depot 

35. Number of days per year that maintenance shops at each level operate 

36. Number of days per year of operation of the equipment 

37. Operating hours per day of the equipment 

38. Confidence limits for stockage of parts, modules, components, and the 
equipment 

39. Probability of false-no-go 

40. Attrition factor 

41. Requirements objective period 

42. Stockage objective periods between levels 

43. Order and shipping times between levels 

44. Turnaround times for modules between levels 

45. Turnaround times for components between levels ' 

46. Economic life 

47. Cost to train each skill -level type 

48. Turnover time for manpower 

49. Percentage factor of total stockage cost for inventory management 

50. Fraction mean-time-to-repair reduced if maintenance is accomplished 
at the depot level 

51. Total cost of research and development 

52. Publication information 



371 





Outputs from the program . - The life-cycle support costs form an 
important category of output information. The support costs are divided into 
the following factors: 

• Test equipment cost 

• Spares and repair parts cost 

• Personnel costs 

• Transportation cost 

• Training costs 

The maintenance allocation for repair of all modules, components, 
and the end item is an output of GEMM. Any module or component that should 
receive throwaway maintenance is indicated along with the level at which 
throwaway should take place. 

The requirements for stock, test equipment and maintenance personnel 
is presented in the output. The stockage requirements are shown as the quan- 
tity required for each level of maintenance. The test equipment requirements 
at each level are presented by type of test equipment and quantity required. 

The skill level designation for the maintenance personnel and the quantity that 
is required at each level of maintenance is indicated. The outputs for test 
equipment and personnel are presented on a per-shop basis. 

Derivation of key equations . - The following discussion concerns the 
derivation of key relationships that are utilized internally within the calculation 
portion of GEMM. The key equations will be presented in the following order: 
Annual Maintenance Manhour, Test Equipment Requirements, Manpower 
Requirements, Transportation and Stockage Requirements, Inventory Manage- 
ment and Training. These are reproduced in part from reference 4. 

Annual maintenance manhour calculations: The Annual Maintenance 
Manhour computer subroutine is exercised for each module and component 
and for the equipment to determine the Annual Maintenance Manhour (AMMH) 


• Inventory management costs 

• Publications cost 

• Research and development costs 

• Production cost 
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requirements for maintenance. The AMMH is defined as the number of fail- 
ures per year multiplied by the mean time to repair (MTTR) per failure, or 

AMMH * (number of failures /year) (MTTR/failure). 

In more detail, this equation becomes, 

AMMH = hours/day x operating days/year) (MTTR/faHure) 

Mean-time-between failure (MTBF) 


Test equipment calculations: The routine that calculated test equip- 
ment requirements makes use of the AMMH information to calculate the test 
equipment required for each module, component and the equipment. The test 
equipment required for the unit under test (UUT), whether it be module, com- 
ponent or equipment, is defined as the AMMH for the UUT divided by the 
number of shop hours available per year. The equation for this becomes. 


Test equipment of type I per shop = 


(AMMH of UUT) X N 
Shop hours available /year 


where N = total number of UUTs per shop. 


In more detail, TE(I) per shop = 


(AMMH of UUT) (UUTs /shop) 

(Operating hours /shop x operating days /year) 


and the total test equipment requirement for type I in the maintenance struc- 
ture is: 


Total test equipment I = TE(I)/shop x number of shops /maintenance structure. 


These calculations are performed for the checkout and repair of the 
equipment being studied and for the repair of each module and component 
within the equipment. The test equipment requirements are summed over all 
the UUTs (modules, components and the equipment) to get the total test equip- 
ment required for full equipment repair capability. 
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Maintenance manpower calculations: The equations for the calculation 
of maintenance manpower requirements are derived in a similar manner using 
the AMMH values for the UUT. In equation form • : 


MOS (I) = ■■ 


(AMMH of UUT) ; 
(MOS hours available). 


or 


MOS (I) per shop = 


(AMMH of UUT) (UUTs/shop) 

(Operating hours/shop x operating days/year x PF) 


where PF = productivity factor. 


The productivity factor indicates the percentage of the time the repair- 
man is productive when he is available. And for the total force structure this 
becomes. 


Total MOS (I) = MOS (l)/shop x number of shops /maintenance! structure. 


Stockage calculations; Stockage calculations are based on the initial 
provisioning period of six months, for the initial provisioning stock, and on 
the consumption rate for. reorder stock. The model calculates stockage 
requirements similarly to the way it is now done manually. 


There are two types of initial provisioning stockage; nonrepairable 
stock and repairable stock. Nonrepairable stock is stockage for items that 
are not repaired such as parts and throwaway items, i. e. ,. throwaway modules, 
throwaway components and throwaway equipments; Repairable stock is 
stockage for items that are repaired such as repairable modules, components, 
and/or end items. 

For nonrepairable stockage, three classes are calculated for initial 
provisioning; 

• Initial -issue quantity 

• Order-ship quantity 

• Replacement, quantity 
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, Initial-issue quantity is the issue of stock that is placed in the field 

concurrently with the initial deployment of an equipment. Order-ship stockage 
is the stock that is necessary to fill the stockage pipe-lines and is based on 
the turnaround time. Finally, the replacement quantity is the nonrepairable 
stock located at the depot that is utilized as backup or replacement stock for 
the field stockage as it is used up. 

For repairable stock there is no need for initial issue stockage or 
replacement stockage. Since the item in question is repairable, it is not 
lost to the system when a failure occurs. The only stockage that is required 
is. pipeline stock which is used to replace the failed item while it is being 
repaired (turned around). This stockage is analogous to order -ship stockage 
for nonrepairables. 

The first step in the derivation of the equation to calculate initial-issue 
stock is to determine the number of failures within a 15 -day period. 

Failures/15 days = operating hours /day x number of days/yesu* 

X 0. 04 mean-time-between-failure (MTBF) 

This mean demand per shop for the stockage objective (B) is calculated 
as follows: 

Mean demand = failures/15 days x number of uses /equipment 
X number of equipments /shop x B, 

where B = number of 15 -day periods in stockage objective which is defined 
as the amount of time for which a maintenance level is allowed to stock. 

Thus, the stock required for a given protection level (K) at a. particu- 
lar support shop becomes, 

1/2 

Initial -issue stock = mean demand + K (mean demand) 
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The total stock required for the entire force structure is therefore. 

Initial-issue stock/force structure = initial issue/shop x number 
of shops in maintenance structure. 

Combining these three types of stockage, the initial provisioning 

■ • ■ . r. ■ '! 

quantity for nonrepairables becomes. 

Total initial provisioning/force structure = initial-issue stock /maintenance 

structure. 

+ order-ship/stock maintenance 
structure, 

+ replacement stock/maintenance 
structure. 

As mentioned previously, only pipeline stockage is required for repair- 
ables as compensation for the turnaround time necessary to affect a repair on 
a failed item. The equation for calculating the mean demand for pipeline stock- 
age per shop is: 

, , ‘ 

Mean demand = failures/ 15 days x turnaround time x number of 
uses / equipment X number equipment /shop. 

For a given protection level K, the pipeline stockage is; 

1/2 

Pipeline stockage = mean demand + K (mean deniahd) per shopl 

The total stock required for the entire airlines maintenance structure 
is:' 

Pipeline stockage /maintenance structure » pipeline stock/shop x shops/ 

maintenance structure. 

Reorder stockage is calculated for both repairables and nonrepairables, 
and is based on the consumption rate. For nonrepairables the reorder stock- 
age is equal to the number of failures expected in the force structure and the 



life cycle plus those failures which will be caused by attrition. Reorder 
stockage for repairables is simply the number of failures caused by attrition 
as all other failures are corrected by repair rather than replacement action. 

Inventory management calculations: Inventory management costs for 
stockage inventories are calculated by the use of an inventory factor. This 
inventory is a percentage of the total stockage costs over the life cycle being 
considered. 

The initial provisioning quantity minus the amount consumed during 
the initial provisioning period is maintained throughout the life cycle, and 
reorder stock is requisitioned for each year after the initial provisioning 
period as stock is consumed. An average reorder stockage is considered 
since the stock is not on hand for the entire period. This average is approxi- 
mated by one-half of the total reorder stock since theoretically, at the begin- 
ning of each year there will be a large quantity of reorder stock on hand and 
at the end of the year there will be none. Thus, the reorder stock divided by 
two is the average reorder quantity on hand during the year. The formula 
yielding the inventory management cost is: 

Inventory management cost Initial provisioning quantity x cost of 
for life cycle = stock x inventory factor x economic life 

Maintenance training calculations: Training costs reflect the number 
of maintenance personnel required, the type of MOS and the turnover rate of 
maintenance types. The formula for maintenance training is: 

Training costs = number of MOS type x cost of training per MOS type x 
life cycle (years) /turnover rate 
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Publications cost calculation; Publications cost are calculated for 
the checkout equipment, fault-isolate-to-component, fault-isolate-to-module 
and fault-isolate-to-part maintenance functions. In general. 

Publications cost = cost per page x number of pages required for 

specific maintenance action. 

Research and development cost: This is the total cost of research and 
development and is an input into the model. It is useful for sensitivity to 
reflect changes in research and development cost when equipment- design and 
failure rates are changed. 

Production cost: This is simply an estimate of the total production 
costs including the cost of prime equipment. 

Overhaul costs; Overhaul costs are considered using a time-between- 
overhaul (TBO) and a cost per overhaul as input information. Overhaul’ costs 
may be considered for modules, components and the end-item. The equation 
for overhaul cost is; 

Cost of overhaul = equipment life cycle /TBO x cost per overhaul. 
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AiPPENDIX B 
GLOSSARY 


- A - 


Access time . - Generally, the time interval between a request for the 
•content of a location in a memory device and the delivery of this information 
(read operation); also time between command to store data in a memory 
location and the completion of the storage (write operation). Access time is 
thus the sum of the waiting time and the transfer time. For random access 
storage devices, the access time is essentially constant. 

Accumulator . - A register (or registers) and associated equipment 
in the arithmetic unit of a computer in which are formed the results of 
various arithmetic and logical operations, such as addition, subtraction, 
(complementing), and shifting (multiplication). 

ACT . - Abbreviation for active control techniques. 

Actuator . - A device which converts an electrical, pneumatic, hydrau- 
lic or mechanical signal to a mechanical output using electric, pneumatic, 
hydraulic or mechanical energy. It may include amplifiers, valves, clutches, 
gears, motors, pumps, transducers, etc. , packaged within the same assembly. 

Accuracy . - The degree of freedom for error of a quantity, as dis- 
tinguished from precision. 

A/D . - Abbreviation for analog /digital. 

Address . - A specific location in the computer (usually a memory 
location) where data or instructions are stored. 
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Address modification . - The changing of the address portion of a 
computer word before the instruction is executed by the use of index registers, 
indirect addressing, or other techniques. 

Alphanumeric. - A symbolic code that contains both alphabetic chaj?ac- 
ters (letters) and numeric characters (digits). Alphanumeric codes generally 
include additional characters such as commas, periods, ampersand, mathe- 
maticeil characters, etc. * 

Analog /digital (A/D) converter. - A device for converting an electrical 
analog signal to a corresponding digital data word. 

Architectxire. - The conceptual and functional structure of the com- 
puter system, excluding the equipment internal organization and detailed 
implementation. Multiple implementations are possible for most architectural 
specifications. 

Arithmetic unit. - The portion of the computer that performs the 
arithmetic and logical operations. 

Assembly language . - A computer language which permits the writing 
of symbolic addresses (such as X or Al) for absolute binary addresses (such 
as 01100 or 11010) and also the writing of symbolic operation codes (such as 
Add or SUB) instead of binary machine operation codes (such as 111 or 011). 
One assembly language statement normally translates into one machine 
instruction. 

Assembly program . - A computer program which translates a 
program written in an assembly language into a machine language program. 

Availability. - Probability that a device or system is functioning 
properly during specific time periods. Availability depends on the time to 
detect faults and repair or reconfigure as well as MTBF. 
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- B - 


Base. - See radix. 

Base register. - A register containing an address which is modified 
by the contents of an address field in an instruction to determine the effective 
address. It is also used to retain linkage addresses for subroutine entry and 
return. A base register generally contains a complete address that is modi- 
fied by a displacement location in the instruction (see index register). 

BCD. - Abbreviation for binary coded decimal. 

Binary . - Pertains to a number system based on the radix 2. Two 
symbols are used, usually 1 and 0. 

Binary coded decimal (BCD) . - Pertains to an encoding technique 
whereby each of the decimal digits 0 through 9 is represented by a unique 
group of binary digits. 

BIT. - Abbreviation for built-in test. May include both software or 
hardware. 

Bit, r Abbreviation for binary digit. A bit is a single character in a 
binary number and has the value of 0 or 1. . 

/ • - 

Buffer. - A temporary storage device used to make possible transfer 
between two devices whose input and output speeds are not matched. 

Bulk modulus . - The compressibility, or hydraulic spring rate, of a 
fluid. Expressed in psi (Ibs/sq. in) and generally decreased with an increase 
in temperature. 

Bus. - A common path for transfer of information between several 
sources and several destinations. 
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Bypass valve, - Means for short-circuiting the flow around a cylinder 
or motor so that its output may be nullified. 

Byte. - A group of binary digits which are handled as a unit. Generally, 
a word composed of an integral number of bits. 


- C - 


CCV. - Abbreviation for control configured vehicle. r 

Centralized. - Refers to a computer system organization in which all 
computationed tasks are performed by a general-purpose computer (see 
dedicated). 

Channel. - Usually a transfer path for specific I/O data. 

Chip. - A single monolithic semiconductor element. A chip may be 
in the form of an IC, MSI, or LSI device or a transistor. 

CMOS. - Abbreviation for complementary metal oxide semiconductor. 

Code. - An arrangement of basic symbols to convey a system of 
notation for example, to use binary 1 and 0 symbols for generating cornputer 
codes such as BCD, octal, etc. 

Compiler. - A computer program which translates a compiler 
language program into a machine language prograni. 

Compiler language. - A procedure-oriented computer programming 
language such as FORTRAN, JOVIAL, PL/1 or SPL. A single compiler 
language statement is generally translated into several machine instructions. 
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, Complement. - A number of quantity that is derived from another 

number or quantity by subtraction in accordance with special rules. Comple- 
ments are used in computers to represent negative numbers and to perform 
^ subtraction, by addition. 

Computer . - A machine which is able to perform sequence of arith- 
metic and logical operations upon information. A digital computer uses 
integers to express all variables and quantities of a problem, whereas an 
analog computer calculates by using physical analogs of the variables. In the 
latter, a one-to-one correspondence exists between each numerical quantity 
occurring in the problem and varying physical measurement (e. g. , voltage 
level). 


Control unit. - A major functional unit of a computer that is the 
traffic controller of the system. It produces timing, control, and command 
signals for execution of the computer program. It causes all elements to 
function together as an integrated system. 

Core memory . - A memory device consisting of an array of ferro-' 
magnetic cores. Generally, each core stores a single binary digit; the 
direction of magnetic polarization determines whether the bit is a 0 or 1. 

Cycle tirhe . - The time interval required to perform a complete 
"read" cycle for a memory, or the minimum time interval between the starts 
of successive accesses to a storage location. 

Cylinder. - The usuaT output member of a hydraulic or pneumatic 
actuator, containing a piston ( or diaphragm) and having a fixed, or limited 
stroke. 


- D - 


D/A . - Abbreviation for digital/ analog. 


383 



Data memory . - See variable memory. 


Data word. - A computer word containing an ordered set of bits used 
to represent a data quantity. 

Dedicated. - Refers to a computer system organization consisting of 
multiple computers, each of which is permanently assigned to a single 
computational function. The individual computers are usually small, special- 
purpose devices, (see centralized). 

Destructive readout (PRO). - Refers to memories in which the read 
process destroys the information in the storage medium. If the information 
is to be re,tained, it must be temporarily stored in an external register (the 
memory ^Suffer register) and then rewritten into the memory. 

Diagnostic routine. - A routine or special program designed to check 
out computer operations. These programs usually isolate and indicate 
malfunctioning areas of a computer, and designate the specific faults. Machine 
diagnostic programs check the computer itself, and program diagnostics 
verify the software. 

Differential pressure sensor (aP sensor) . - An instrument for 
measuring the difference between the pressures existing on either side of a 
piston in a cylinder. It can have an electrical, mechanical hydraulic, or 
pneumatic output which is of some mathematical relationship to the differences 
in the pressures sensed. 

Digital . - Representation of a quantity using digits or discrete steps. 

Digital /analog (D/A) converter. - A device for converting a digital 
value to a corresponding electrical analog output signal. 
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Digital strut , - A series- connected group of cylinders (usually 
hydraulic) arranged in binary- coded output stroke capability and each having 
an associated valve connected so that each may be capable of going to either 
of two positions. The output position of the strut is the digital sum of the 
individual cylinders (bits). 

Discretes. - Output control levels generated by the computer or input 
control levels interpreted by the computer. Discretes are constrained to 
binary values (i. e. , 0 or 1), and generally indicate the occurrence of a specific 
event in the system of the state of some particular device or switch. 

Direct memory access. - Refers to a type of I/O channel which permits 
data transfer directly between memory and external devices under external 
device control. 

Double precision. - Refers to the use of two data words to represent 
a single number, thereby gaining increased precision. ^ 

\ 

Driver actuator . - An actuator, usually having redundant inputs, with 
relatively low output power capability and used primarily to position the 
input of larger, or power, actuators. 


- E - 

EHV. - Abbreviation for electro-hydraulic valve. 

Electrohydraulic servovalve . - A device for controlling the flow or 
pressure of a hydraulic fluid with an electrical signal; flow or pressure (or a 
specified combination) is usually proportional to input current. 

EMI. - Abbreviation for electromagnetic interference. 


385 



Engage valve. - A device for initiating the operation of a hydraulic 
or pneumatic actuator by electrical, mechanical, hydraulic or pneumatic . 
signal. In addition to controlling the supply of power fluid into the actua^r, ^ 
it may include bypass and other special purpose valving. Operation usually 
refers to "off*’ mode upon removal of control signal. 

Error . - A miscalculation in the program being executed by the com- 
puter; either is not expected or an incorrect result is .computed. Both types 
of errors may be caused at once by some faults. 

Error-detecting codes. - Codes wherein data words contain additional 
checking bits to allow detection of errors that occur in data handling, and often 
to determine which bit is in error. Many coding techniques for adding redun- 
dancy digits are in use and differ in their ability to detect and/or correct 
multiple errors. \ 

Executive. - A supervisory program which allocates the processor 
resources among programs and controls the peripherals to be employed for 
a specific program. 


- F - 

Failure. - A malfunction caused by component failure or degradation. 
Failures are considered "hard" if the malfunction is continuous or "intermittent' 
if it only occurs occasionally. An intermittent failure is typified by a soldered 
joint which opens momentarily under vibration and temperature stress. 

Fault. - The deviation of a logic variable from its prescribed value.. 
Most faults will cause an error. A transient fault is a temporary logic 
deviation caused by an intermittent component failure or by external inter- 
ferences (e. g. , power supply irregularities or EMI). A permanent fault is 
the result of a hard component failvtre. 
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Fault tolerance. - Ability of a computer to execute error-free pro- 
grams in the presence of a fault. Fault tolerance in digital computers is 
achieved by means of protective redundancy, and must be qualified by the 
classes of faults that are tolerated and the parts of the computer in which 
they inay occur. 

Fixed memory . - See read-only memory. 

Fixed point . - Referring to the representation of a number by a 
single set of digits with a constant implied location of the radix point. 

Floating point. - Referring to the representation of a munber by two 
sets of numbers, one containing the mantissa and the other the location of the 
radix point. 

. . . . j 

Fvinctional test. - A test designed to check out the operation of the 
system hardware. 


- G - 


Gate. - A circuit which has the ability to produce an output that is 
dependent upon a logical function of the inputs; e. g. , an AND gate has an out- 
put when all inputs assume a logical ONE or TRUE state. 


- H - 


Hexadecimal. - Pertains to a number system with a radix of 16. The 
hexadecimal system is convenient for compactly representing a binary number 
by dividing it into 4-bit bytes. 


- I - 


IC . - Abbreviation for integrated circuit. 
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Index register. - A separate register whose contents is used to modify 
an explicitly specified address without changing the program in memory. It 
generally contains a count which is added to the address in the instruction 
itself or in the instruction plus an extension register, as distinguished from a 
base register which generally contains a complete address. Index registers 
are often used to provide loop control in iterative programs and to designate 
return addresses at the conclusion of subroutines. 

Indirect addressing . - Designating an address that contains the location 
of the desired operand. 

Input/output (I/O) . " All information transmitted between the computer 
and its interfacing systems. 

Instruction . - A set of characters in a computer that specified an 
op.eration to be: performed by the computer and usually the location or value 
of some of the operands and/or results. 

Instruction repertoire . - The set of instructions which can be per- 
formed by a particular computer. 

Instruction word ,. - A computer word containing an instruction. 

Integrated actuator. - The electrohydraulic servovalve, hydraulic 
amplifiers, surface actuator, and associated functions are integrated in a 
single package. No input linkages are required. 

Integrated circuit (IC) . - An electronic circuit which is fabricated in 
an integrated process and which is capable of performing the functions of a 
conventional circuit coniposed of discrete components such as transistors, 
resistors, diodes, etc. 
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Interface . - The matching circuitry required to allow the transmission 
of data between two devices. 

Interrupt . - An externally or internally generated signal that interrupts 
the current sequence of the program being performed and causes a new 
sequence to be performed. 

I/O . - Abbreviation for input /output. 


- L - 


Large-scale integration (LSI) . - The fabrication of more than 100 
integrated logic gates together in one assembly. 

Logic levels. - The nominal voltage levels which are used to represent 
binary 0 or 1 in logic circuits. For instance, in commerical resistor- tran- 
sistor-logic (RTL) circuits, the levels are generally 0 and +2. 5 V; in diode- 
transistor-logic (DTL) circuits, they are generally 0 and +3. 5 V. 

LVDT . - Linear variable differential transformer; a transducer pro- 
viding an electrical output (ac) whose phase and amplitude is proportional to 
the direction and amplitude of the physical position of the sensing element. 

• i 

.. LSI . - Abbreviation for large-scale integration. 


- M - 


Machine language. - Coded instructions in binary digit form for use in 
the computer. 

Magnetic core. - A ferromagnetic ring or core used to store a bit 

of data. 
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Masking . - Denotes the selection of particular bits of a computer word. 


Mean time between failures (MTBF) . - Reciprocal of the average rate 
of failure of a piece of equipment. MTBF is a frequenUy used measure of a 
computer's reliability, but to be meaningful a quoted MTBF must be accom- 
panied by a full description of the assumptions and conditions used in the 
calculation. 

Medium scale integration (MSI) . - The fabrication of 25 to 100 inte- 
grated logic gates together in one assembly. 

Memory protect . - The technique for sensing potential power failures 
and preventing the loss of data in the memory and in critical registers. 

Memory word . - An ordered set of bits in the cornputer's primary 
storage device. It can contain either data words or instructions words. 

MHD . - Abbreviation for magneto hydro-dynamic. 

MQS . - Abbreviation for metal- oxide -semiconductor. . 

MOSFET . - Abbreviation for metal-oxide- semiconductor-field-^effect- 
transistor. 

MSI . - Abbreviation for medium-scale integration. 

I MTBF . - Abbreviation for mean time between failures. 

Multicomputer . - A computer configuration having two Or more sets 
of memories and processors, which are generally assigned different tasks. 

A multicomputer is distinguished from a multiprocessor in that the processors 
do not share memories. 
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Multilayer . - Printed circuit board construction technique whereby the 
wiring is in the form of etched lines and where many layers make up the 
complete board unit. Interconnection between layers is performed normally 
by plated-through holes. 

Multiplexed data. - Data from several devices which have been combined 
to be transmitted through a single channel, either by interleaving them or by 
sampling them in sequential order. 

Multiproce ssor . - A computer configuration having two or more 
processors which share memory or memories and I/d. 


- N - 


NDRO. - Abbreviation for nondestructive readout. 

Nondestructive readout (NDRO) . - Refers to memories from which 
information can be read without destruction of any word in the storage device. 

Nonvolatile . - Refers to memories which do not lose their information 
contents when power is removed. 

Numerical control (N/C) . - The system of controlling (usually) machine 
tools with a numerical (digital) signal. Actuation can use electrical, hydraulic 
or pneumatic power and can be controlled, read, signalled and/or computed 
electrically, optically, pneumatically or hydraulically and usually in some 
combinations of these methods. 


- O - 


Octal. - Pertains to a number system with a radix of 8. The octal 
system is convenient for compactly representing a binary number by dividing 
it into 3-bit bytes. , 
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One's complement. - The complement of a .binary number obtained by 
changing each 1 tp 0 and each 0 to 1. An alternate method is tp subtract the 
number from all ones, . . . 

Operand . - Data used in an operation. 

Operation . - The arithmetic, logic, or transfer action that. the corn- 
puter performs as a result of interpreting a .single instruction. . 

. Overflow . - A condition that occurs when a computation produces an 
answer that exceeds the storage capacity of a, register. 


- P - 


ParalleL - Refprs to the simultaneous transmission and/or processing 
of all bits of a word via a separate line or channel for each bit. 

Parity check . A, method for checking the validity of a binary word or 
byte. The check is usually made by use of a parity bit suffixed to the original 
word, which indicates whether the sum is odd or even. This technique can be 
used to generate more complete checks. 

Peripheral . - Refers to equipment external to the computer but directly 
associated with the I/O section, such as magnetic tape transports or paper 
tape punches and readers,. 

Plated-wire . - A type of film memory where information is stored in 
a thin magnetic film deposited over the bit wire. 

PMOS . - Abbreviation for p- channel metal oxide semiconductor. 

Position tranducer . - A device for producing an electrical, hydraulic, 
pneumatic or mechanical output signal as a function of input position. Poten- 
tiometers, LVDTs, fluidic sensors, and springs are examples. 
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Precision . ~ The degree of discrimination with which a data quantity 
is represented. For instance, a two-digit decimal number discriminates 
among 100 possible values. Precision should be distinguished from accuracy. 

Pressure transducer . - A device for providing an electrical, hydraulic, 
pneumatic or mechanical output signal as a function of input hydraulic or 
pneumatic pressure. 

Processor . - That portion of a computer that consists of control and 
arithmetic units. The basic I/O interface is often included. 

Program . - A sequence of instructions and necessary numerical con- 
stants that will cause the computer to operate on a given problem. 

Program memory . - That portion of the computer memory which is 
used for storage of program instructions and constants. It may be either 
"read-only" or read-write, as distinguished from the variable memory which 
is always read-write. 

PROM . - Abbreviation for programmable read only memory. 


- R - 

Radix. - The base number of a number system. Example: 2 in binary, 
10 in decimal, 8 in octal, 16 in hexadecimal," etc. 

Random access. - Refers to a storage device in which the time 
necessary to "access" any memory location is constant and independent of 
the relative locations of the last addressed location and the next location to 
be addressed. Magnetic core memories have this characteristic while driun 
memories do not. In the latter, physical location influences the amovint of 
delay of access. 


393 



Read . - To sense and transfer information contained in memory to 
another storage or operating register of the computer. 

Read-only . - Refers to a memory device that outputs a selectable word, 
but this word cannot be altered by the processor during its operation. 

Read-write . - Refers to a memory device which can be both read from 
and written into during normal operation. 

* » 

Reconfiguration . - Reorganization of the computer into a new system 
without the. failed part. Sometimes the computing capacity of the system is 
reduced by reconfiguration, and the fault is thus only partially tolerated. 
Partial fault tolerance is sometimes referred to as graceful degradation. 

Recovery . - The actions necessary to maintain information continuity 
in a computer system following a transient error or reconfiguration. 

Redundancy . - The use of additional circuits and/or components that, 
would not be needed in a "perfect" system, but which serve to provide fault 
tolerance in a real system. 

Register . - A device for temporarily storing a single word in prepara- 
tion for Operating on it. It may store data, instructions, memory addresses, 
or any other ordered set of bits.- Usually it can be loaded or emptied very 
quickly. 

Reliability . - The probability that a piece of equipment or system will 
perform as specified for a given period of time when used in the specified 
manner. 

Repertoire. - See instruction repertoire. , 

ROM . - Abbreviation for read only memory. This memory, requires' 
a non-destructive readout. 
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Scaling. - Multiplying variables by an appropriate constant (the scale 
factor) to allow their representation in a given- fixed- point numerical system. 

Scratchpad memory. - A high-speed (generally small) memory which 
can be directly addressed by the processing circuitry. 

Secondary actuator . - See driver actuator. 

Self-test. - A test exercised by the computer itself, designed to check 
its functional operation. 

Serial . - Refers to the sequential transmission and/or processing of 
the bits of a word through a single line or channel. 

Serial- parallel. - Refers to the simultaneous transmission and/or 
processing of bits in a byte through parallel lines or channels. The trans- 
mission or processing of a complete word requires several sequential b3des. 
This type of data flow is a combination of serial and parallel operations. 

Servoactuator . - An actuator which normally operates in the closed 
loop of a servomechanism; includes actuation elements plus feedback devices 
and proportional input devices such as servovalves, etc. 

Servovalve. - A device for proportionally controlling the flow and/or 
pressure in a hydraulic or pneumatic servosystem. Control may be electrical 
(see electrohydraulic servovalve), hydraulic, pneumatic or mechanical. 

Shift. - Moving the characters of a unit of information colximn-wise 
right or left from one storage cell to another, usually in a register. For a 
number, this is equivalent to multiplying or dividing by a power of the base of 
the notation. 


395 



Simulation . - The process of modeling or logically duplicating a 
system by programming its features on a general-purpose computer. 

Single -point failure . - A potential failure point in a redundant control 
or actuation system which can ultimately cause a failure in all channels of ‘ 
the system. ' 

Software. - All of the computer programs written for use in a com- 
puter system. Support software includes assembly programs, compilers, 
utility routines, etc. Operational software refers to flight programs, test 
programs, etc. 

SPAD . - Abbreviation for scratch pad memory. 

Static redundancy . - The use of massive replication of each component 
or circuit to two or more copies, which are permanently connected and powered. 
A component failure or logic fault is instantaneously and automatically masked 
by the presence of the redundant copies of the same item. 

Stepper motor . - A motor which moves a predictable portion of its 
total motion potential when provided with an input command or pulse. Used 
extensively in point-to-point N/C machine tool systems. 

Subroutine. - A subprogram that can be part of another routine. 
Subroutines can be closed, which means they are stored in one place and 
accessed by other programs when needed, or open which means they are 
inserted each time they are used. 
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Temporary memory . - The part of memory which contains data to be 
processed or computational results. Sometimes called the data memory, it 
provides read- write storage. 
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Throughput . - The total flow of useful information through a computer 
during some given period of time. 

Translate. - To convert one type of language (special codes, other 
machine languages, etc. ) to another language suitable for operations within 
the computer. 

TTL. - Abbreviation for transistor-transistor logic. 

Two-address. - Signifies that two addresses are contained in each 
instruction. For example, the address of one operand and the address of the 
next instruction. 

Two*s complement. - The complement of a binary number found by 
changing each 1 to 0 and adding 1 to the number 
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Variable memory. - That portion of the computer memory which is 
used for storage of temporary data or computational results. It is always a 
read-write memory, as distinguished from the program memory which is 
often "read-only. " 

Volatile . . - Refers to a memory which loses its information contents 
when power is removed. 
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Word. - A series of bits of prescribed length which is treated by the 
computer circuits as a unit. The word is the basic format in which the com- 
puter transmits information. Ordinarily a word is treated by the control unit 
as an instruction and by the arithmetic unit as a data quantity. 


397 



Word lengrth. - The number of bits in a word. Word lengths may be 
fixed or variable depending on the particular computer. 

Write . - To store information into the system memory from the input 
data or from an operating register of the system. 



APPENDIX C 

SYSTEM SENSITIVITY STUDIES 


The candidate configurations allow the examination of processor, 
gyro, or actuator changes while other system components remain fixed. In 
addition, other items of system operation may be varied to determine effects 
on life-cycle cost. These include amount of stock on hand, component repair 
turnaround time, and repair time improvement. 


Effect of Processor Change 

Figure Cl shows the effect on several system parameters produced 
by different processor configurations. Comparison of systems 6 and 8 shows 
the changes from a large-processor to a multiple-processor concept. Included 
in the change, however, is a decrease in the amount of crossfeed and the 
method of handling it, i. e. , analog and digital. 

The change from 6 to 9 reflects an increase in intercom capability, 
as well as improved actuator comparison monitoring, still maintaining the 
large processor. System 3 reflects the impact of the data bus or multiplex 
concept. This requires a significant increase in electronics with a reduction 
in cabling. 


Effect of Actuator Configuration Change 

Figure C2 shows a given processor and sensor configuration with 
three different actuator concepts. The triple -integrated actuators are less 
expensive simply because there is less hardware. This is basically the 
same reason for the difference between the quad-integrated and driver-power 
concepts. The driver-power set requires four drivers and three power 
actuators, while the integrated actuator set requires one of each for a total 
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SYSTEM 6 QUAD, LARGE PROCESSOR, ANALOG CROSSFEED, COMP MONITOR 
SYSTEM 9 QUAD, LARGE PROCESSOR, INTERCOM, COMP MONITOR 
SYSTEM 8 QUAD, MEDIUM PROCESSOR, SMALL PROCESSOR I/O, COMP MONITOR • 
SYSTEM 3 QUAD, LARGE PROCESSOR, DATA BUS, IN LINE MONITOR 

QUAD CONVENTIONAL SENSORS QUAD INTEGRATED ACTUATORS 


LIFE CYCLE MATERIAL SUPPORT 

COST M$ $/FLITE HOUR $/FLITE HOUR 


OPS PRODUCTION 

RELIABILITY COST 

(X lO'^l K$ 



Figure Cl. - Effect of Processor Change 


SYSTEM: QUAD, ANALOG CROSSFEED, COMPARISON MONITOR 

LARGE DIGITAL PROCESSORS. 

SYSTEM 7 TRIPLE INTEGRATED ACTUATORS 
SYSTEM 6 QUAD INTEGRATED ACTUATORS 
SYSTEM 17 QUAD DRIVER-POWER COMBINATION 


OPS PRODUCTION 

LIFE CYCLE MATERIAL SUPPORT RELIABILITY COST 

COST M$ $/FLITEHR $/FLITE HR (X lO'^) K$ 

r> 



. 7 6 17 7 6 17 7 6 17 7 . 6 17 7 6 17 


Figure C2. - Effect of Actuator Configuration Change 
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of four. Note, however, that the difference lies in the life-cycle costs, 
since a production cost comparison shows the driver-power set to be more 
desirable. 


Effect of Gyro Configuration Change 

Figures C3, C4 and C5 show- the relationship among several gyro 
configurations. Some of these are not recommended as possible configurations, 
but are provided simply as data points. These are the complete substitution 
of laser and MHD gyros for conventional gyros in all places including flutter- 
rate sensing. The requirements at these locations do not justify the additional 
cost. 


Figure C3 shows the effect of going to a pentad configuration for body 
rates using conventional sensors. While the life-cycle costs decrease, due 
to the reduction of hardware, the operational reliability becomes completely 
unacceptable. 

System 14A exhibits the change due to the direct substitution of MHD 
gyros for all conventional gyros. While not indicating much change in pro- 
duction cost or in operational reliability, the life-cycle cost impact is signifi- 
cant. This is due primarily to the two-axis capability of each gyro unit, and 
the consequent reduction of hardware. 

Figure C4 shows the effect of the change from conventional quad 
sensors to skewed hexad accelerometers, and skewed hexad laser gyros. 

This is shown by comparing systems 7 and 4, which does not represent a 
significant life-cycle cost saving and, in addition, shows a sizeable decrease 
in operational reliability. The direct one-to-one replacement of laser for 
cpnventional gyros shows a significant life-cycle cost increase. 

Figure C5 again shows a one-for-one conventional-to- laser -gyro 
replacement and, again, exhibits a marked increase in life -cycle cost. The 
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SYSTEM: TRIPLE, INTERCOM. IN LINE MONITORING, MINIMUM INTEGRATED ACTUATORS 

TRIPLE LARGE PROCESSORS 

SYSTEM 14 TRIPLE CONVENTIONAL SENSORS 

SYSTEM 14A MHD GYROS IN TRIPLE CONFIG (ALL PLACES) 

SYSTEM 16 SKEWED PENTAD CONVENTIONAL GYROS (BODY ONLY) 


LIFE CYCLE 
COST M$ 


OPS PRODUCTION 

MAT! SUPPORT RELIABILITY COST 

$/FLITE HR l/FLITE HR ' (XIO'^I K$ 



14 14A 16 . 14 14A 16 . 14 14A 16 14 14A 16 14 14A 1 


Figure C3. - Effect of Gyro Configuration Changes - 
Systems 14, 14A and 16 , 


SYSTEM; QUAD, CROSSFED CHANNELS, COMPARISON MONITOR, TRIPLE INT ACTUATORS 
QUAD LARGE DIGITAL PROCESSORS . 

SYSTEM? • CONVENTIONAL QUAD SENSORS , ‘ : 

SYSTEM 7A LASER GYROS IN QUAD CONFIGURATION (ALL PLACES) 

SYSTEM 4 SKEWED HEXAD ACCEL & LASER GYROS (BODY ONLY) 


OPS PRODUCTION 

LIFECYCLE MAT! SUPPORT RELIABILITY COST 

COSTM$ $/FLITEHR $/FLITE HR (X 10‘A K$ 



7 7A 4 7 7A 4 7 7A 4 7 7A 4 7 7A 4 


Figure C4. - Effect of Gyro Configuration Changes - 
Systems 7, 14 and 4 
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SYSTEM: QUAD, INTERCOM CHANNELS, COMPARISON MONITORING 

OUAD INTEGRATED ACTUATORS, OUAO LARGE PROCESSORS 

SYSTEM 9 CONVENTIONAL OUAD SENSORS 

SYSTEM 9A LASER GYRO’S IN QUAD CONFIGURATION (ALL PLACES) 

SYSTEM 11 6 MHD GYRO'S IN QUAD CONFIGURATION (BODY ONLY, NOT SKEW) 


OPS PRODUCTION 

LIFE CYCLE MAT’L SUPPORT RELIABILITY COST 

COSTMI $/FLITEHR $/FLITEHR (X 10*^) K$ 



9 9A 11 9 9A 11 9 9A 11 9 9A 11 9 9A 11 


Figure C5. - Effect of Gyro Configuration Changes - 
Systems 9, 9A and 11 
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direct substitution of MHD gyros for the conventional body-rate gyros (not 
skewed) proves far more beneficial, however. This again is due to the two- 
axis capability, and the subsequent reduction of hardware. 


Table Cl summarizes the above data by indicating a percentage 
change from the noted reference. 

TABLE Cl. - PERCENT CHANGE IN LIFE CYCLE COST 
FOR CONFIGURATION CHANGE 



Quad 

Triple ' 


int 

hnt 

Actuator configuration 

-1. 5 

-9. 0 

(driver power off) 





Skew hex ad 

Quad 

Quad 


conv accel 

conv accel 

conv accel 


laser gyro 

MHD gyro 

laser gyro 


(body only) 

(body only) 

(all places) 

Gyro and accel 

-2. 2 

-7. 0 

+12. 0 

configuration 




(quad conv ref) 





Skew pentad 

j 

Triple 


conv accel 

conv accel 


conv gyro 

MHD gyro 


(body only) 

(all places) 

Gyro and accel 

-6. 2 

-16.9 

configuration 

■ 



(triple conv ref) 





Maintenance Sensitivities 

Several parameters associated with the maintenance policy are of 
interest. The first is the effect of a reduction in repair turnaround time. 
The GEMM program input was changed to reflect a 15 percent reduction in 
turnaround time for which a 0. 06 percent reduction in life-cycle cost was 
indicated. Associated with this, a 20 percent reduction in mean repair time 
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was implemented with a resulting 0. 02 reduction in life-cycle cost. Even 
considering both of these parameters added together, the resulting cost 
saving is less than 0. 1 percent. 

A measure of improvement may be obtained by an increase in elec- 
tronic part MTBF. The indicated failure rates were modified to high- 
reliability levels wherever this was applicable and data existed. This causes 
the initial total system production cost to increase by 3. 4 percent, with a 
2. 0 percent reduction in life-cycle cost. In terms of dollars, this is roughly 
a 1. 8-M$ increase for the 200 systems against a projected 3. 9-M$ saving in 
total life cost. This reflects a factor of 1. 15 improvement in system MTBF. 

Significant cost savings could be realized with improvements in sensor 
and actuator MTBF; however, the failure rates used for these items are 
thought to be representative of conventional technology by the anticipated ATT 
time period. In addition, advanced technology sensors are included in the 
study. 


A further parameter of interest is the effect of the stockage level 
maintained to assure a spare part being on hand at a repair shop, when the 
repair is needed. Variation of this "confidence" level from 98 to 80 percent 
reduces the life-cycle cost by 1 percent as shown in Figure C6 for system 13. 
The mean downtime, however, increases significantly and is plotted in 
Figure C6. 

There is some point at which increasing mean downtime would cause 
an increase in dispatch cost; however, this crossover point was not computed. 
This was due to the relatively small cost to achieve the proper stockage level 
and the fact that sensitivity studies of that type were not a prime study requisite. 
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